1038973 - Allow Content-Security-Policy reports to be intercepted by ServiceWorkers

Status: RESOLVED DUPLICATE of bug 1147996

(Core :: DOM: Workers, defect)

Description

[Alex]

Content Security Policy provides a mechanism for violations to be reported to a URL that has been specified via the report-uri directive.

However, the data format that it is sent in is fixed and doesn't give javascript the ability to inspect or massage the data before it is sent to the server.

It would be helpful if a ServiceWorker could intercept and examine the request so that we could, e.g. reduce network traffic from known issues such as chrome extensions or send the data back in a more convenient format for the CSP report collector.

I talked to nsm about whether this feature was going to be implemented, but was told this sounded like a spec issue, so I filed a spec bug at https://github.com/slightlyoff/ServiceWorker/issues/367

And received some clarification saying that CSP reports should be considered resource requests for the purposes of Service Workers, so it sounds like this is already covered by the spec.

I've also received some indication from dveditz that the securitypolicyviolation event that was pointed out to me in that github thread is not likely to be implemented in Firefox (and would have a longer timeline to implemention than ServiceWorker integration anyway).

Comment 1

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

jdm does this already happen? Feel free to bump to v2 if you feel that is more appropriate.

Comment 2

[(no longer active)]

I already fixed this a while ago.