CSP report-to and report-uri
Where the browser sends violation reports.
- Falls back to
- nothing — must be set explicitly
- Group
- Reporting and hardening
Detail
Without a reporting endpoint you have no idea what your policy is blocking, which is why report-only rollouts stall. report-uri is deprecated but still far more widely supported than report-to; setting both is currently the pragmatic choice. Expect substantial noise from browser extensions injecting script into pages.
Example
report-uri /csp-report; report-to csp-endpoint