Repository: angular
Issue: Service Worker is blocking CSP violation reports
Labels: type: bug/fix,help wanted,freq1: low,area: service-worker,cross-cutting: CSP,state: needs more investigation,P3

<!--🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅

Oh hi there! 😄

To expedite issue processing please search open and closed issues before submitting a new one.
Existing issues often contain information about workarounds, resolution, or progress updates.

🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅-->


# 🐞 bug report

### Affected Package
<!-- Can you pin-point one or more @angular/* packages as the source of the bug? -->
<!-- ✍️edit: --> The issue is caused by package @angular/service-worker


### Is this a regression?

<!-- Did this behavior use to work in the previous version? -->
<!-- ✍️--> Unknown


### Description

<!-- ✍️--> My page includes a CSP (Content Security Policy) violation. The header specifies a reportURI. When the browser attempts to send the violation report that request is handled by the service worker. The service worker fails to send the report with this error:

`Fetch API cannot load https://mikvah.report-uri.com/r/d/csp/reportOnly. Request mode is "no-cors" but the redirect mode is not "follow".
(anonymous) @ ngsw-worker.js:2709
`

## 🔬 Minimal Reproduction
Have a webserver serve an application that creates a CSP violation, for example send a header like:
`content-security-policy-report-only: img-src www.permitted.com; report-uri https://a-diffefrent-domain.com/r/d/csp/reportOnly'

and include an img tag for an image from a different domain (aside from permitted.com)

Ensure that your Angular setup creates a service worker.

Open the page, triggering a violation and a report.

## 🔥 Exception or Error
<pre><code>
<!-- If the issue is accompanied by an exception or an error, please share it below: -->
<!-- ✍️-->
Fetch API cannot load https://mikvah.report-uri.com/r/d/csp/reportOnly. Request mode is "no-cors" but the redirect mode is not "follow".
(anonymous) @ ngsw-worker.js:2709
</code></pre>


## 🌍  Your Environment

**Angular Version:**
<pre><code>
<!-- run `ng version` and paste output below -->
<!-- ✍️-->
     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI: 8.1.0
Node: 10.15.3
OS: darwin x64
Angular: 8.1.0
... animations, cli, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... platform-server, router, service-worker

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.801.0
@angular-devkit/build-angular     0.801.0
@angular-devkit/build-optimizer   0.801.0
@angular-devkit/build-webpack     0.801.0
@angular-devkit/core              8.1.0
@angular-devkit/schematics        8.1.0
@angular/pwa                      0.801.0
@ngtools/webpack                  8.1.0
@schematics/angular               8.1.0
@schematics/update                0.801.0
rxjs                              6.5.2
typescript                        3.4.5
webpack                           4.35.2
</code></pre>

**Anything else relevant?**
<!-- ✍️Is this a browser specific issue? If so, please specify the browser and version. -->
Google Chrome Version 75.0.3770.100
<!-- ✍️Do any of these matter: operating system, IDE, package manager, HTTP server, ...? If so, please mention it below. -->