search

paragonie / csp-builder

Build Content-Security-Policy headers from a JSON file (or build them programmatically)
https://paragonie.com/projects
MIT License
543 stars 40 forks source link

Ability to set both "report-uri" AND "report-to" #37

Closed OwenMelbz closed 3 years ago

OwenMelbz commented 5 years ago

Hi,

Recently report-uri has been deprecated - however it's still recommended to provide a URL for this field for older browsers.

However browsers like Chrome are now only using the report-to which defines a group within a new Report-To response header.

Currently the code just runs $compiled []= 'report-to ' . $this->policies['report-uri'] . '; ';

This means the value is always the same for both.

Would it be possible to allow individual control for the report-to directive? this way we can leave a URL for older browsers in the report-uri section and then have a group name in the report-to directive? e.g. something maybe like:

if (empty($this->policies['report-to'])) {
    $compiled []= 'report-to ' . $this->policies['report-uri'] . '; ';
}

Then if the developer defines a report-to it will allow it?

iangcarroll commented 5 years ago

Fixed in #42!