Chrome not reporting CSP violations

user_4913984 0
Viewed 1289

For some reason, Chrome (or at least my Chrome) isn't reporting CSP violations. It correctly refuses to display prohibited content, but it doesn't report the violation. By way of comparison, Firefox reports the violation just fine.

Consider this page. Your browser should not display an image in that page, because that image is from a prohibited URL. Chrome does that part just fine. However, Chrome does not obey the report-to or report-uri directives (I have both). Again, Firefox obeys those directives.

I understand that a browser may choose not report redundant violations, but that's not the case here. I've tried using different urls and none of them produce reports.

I'm using Chrome Version 75.0.3770.90 (Official Build) (64-bit)

Any help is appreciated.

content-security-policy google-chrome
1 Answers

You may listen 'securitypolicyviolation' event and report manually

if(window.chrome /* and before the not-reporting issue gets fixed */) {
  let reportUri='http://localhost:8080/api/csp-report';
  document.addEventListener('securitypolicyviolation', (e)=> {
    let data=JSON.stringify({
      'csp-report':{
        'blocked-uri': e.blockedURI,
        'document-uri': e.documentURI,
        'original-policy': e.originalPolicy,
        'referrer': e.referrer,
        'script-sample': e.sample,
        'source-file': e.sourceFile,
        'violated-directive': e.violatedDirective
      }
    });
    fetch(reportUri, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/csp-report'
      },
      body: data,
      credentials: "omit",
      cache: "no-cache",
      referrerPolicy: "no-referrer"
    });
  });
}
user_21895440
Related