CSP: report-uri

The HTTP Content-Security-Policy (CSP) report-uri directive instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

The directive has no effect in and of itself, but only gains meaning in combination with other directives.

CSP version	1
Directive type	Reporting directive
This directive is not supported in the <meta> element.

Syntax

Content-Security-Policy: report-uri <uri>;

<uri>

A URI where to POST the report to.

Examples

See Content-Security-Policy-Report-Only for more information and examples.

Content-Security-Policy: default-src https:; report-uri /csp-violation-report-endpoint/

Specifications

Specification	Status	Comment
Content Security Policy Level 3 The definition of 'report-uri' in that specification.	Editor's Draft	No changes.
Content Security Policy Level 2 The definition of 'report-uri' in that specification.	Candidate Recommendation	Initial definition.

Browser compatibility

See also

• Content-Security-Policy
• Content-Security-Policy-Report-Only