CSP: report-uri
===============

**Deprecated:** This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

 The deprecated HTTP `Content-Security-Policy` (CSP)
 **`report-uri`** directive instructs the user agent to report
 attempts to violate the Content Security Policy. These violation reports consist of JSON
 documents sent via an HTTP POST request to the specified URI.


**Warning:** Though the `report-to` directive is intended to replace the deprecated **`report-uri`** directive,
 `report-to` isn't supported in most browsers yet.
 So for compatibility with current browsers
 while also adding forward compatibility when browsers get `report-to` support,
 you can specify both **`report-uri`** and `report-to`:



```http
Content-Security-Policy: …; report-uri https://endpoint.com; report-to groupname
```


 In browsers that support `report-to`,
 the **`report-uri`** directive will be ignored.


 The directive has no effect in and of itself, but only gains meaning in combination
 with other directives.


|  |  |
| --- | --- |
| CSP version | 1 |
| Directive type | Reporting directive |
| 
 This directive is not supported in the `<meta>`
 element.
  |

Syntax
------


```http
Content-Security-Policy: report-uri <uri>;
Content-Security-Policy: report-uri <uri> <uri>;
```


<uri>

A URI where to POST the report to.

Examples
--------

 See `Content-Security-Policy-Report-Only` for more information and
 examples.


```http
Content-Security-Policy: default-src https:; report-uri /csp-violation-report-endpoint/
```


`/csp-violation-report-endpoint/` could for example run a PHP something like
 the following that logs the JSON detailing the violation and, if the violation is the
 first one added to the log file, sends an email to an administrator:


```php
    <?php

 // Start configure
 $log\_file = dirname(\_\_FILE\_\_) . '/csp-violations.log';
 $log\_file\_size\_limit = 1000000; // bytes - once exceeded no further entries are added
 $email\_address = 'admin@example.com';
 $email\_subject = 'Content-Security-Policy violation';
 // End configuration

 $current\_domain = preg\_replace('/www\./i', '', $\_SERVER['SERVER\_NAME']);
 $email\_subject = $email\_subject . ' on ' . $current\_domain;

 http\_response\_code(204); // HTTP 204 No Content

 $json\_data = file\_get\_contents('php://input');

 // We pretty print the JSON before adding it to the log file
 if ($json\_data = json\_decode($json\_data)) {
 $json\_data = json\_encode($json\_data, JSON\_PRETTY\_PRINT | JSON\_UNESCAPED\_SLASHES);

 if (!file\_exists($log\_file)) {
 // Send an email
 $message = "The following Content-Security-Policy violation occurred on " .
 $current\_domain . ":\n\n" .
 $json\_data .
 "\n\nFurther CPS violations will be logged to the following log file, but no further email notifications will be sent until this log file is deleted:\n\n" .
 $log\_file;
 mail($email\_address, $email\_subject, $message,
 'Content-Type: text/plain;charset=utf-8');
 } else if (filesize($log\_file) > $log\_file\_size\_limit) {
 exit(0);
 }

 file\_put\_contents($log\_file, $json\_data, FILE\_APPEND | LOCK\_EX);
 }
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-report-uri |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `Content-Security-Policy-Report-Only`
* `report-to`