Page MenuHomePhabricator

CSP report-uri is deprecated
Closed, ResolvedPublic

Description

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri

This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

Though the report-to directive is intended to replace the deprecated report-uri directive, report-to isn’t supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to

Screenshot 2020-04-06 at 16.36.59.png (1,900×896 px, 168 KB)

Event Timeline

Reedy added a subscriber: Bawolff.

Fwiw, deprecated or not all browsers seem to support it and no browser seems to have plans to remove it

Reedy triaged this task as Lowest priority.Apr 6 2020, 3:40 PM
Reedy moved this task from Incoming to Back Orders on the Security-Team board.

Change 1008045 had a related patch set uploaded (by Alistair3149; author: Alistair3149):

[mediawiki/core@master] Set report-to directive in CSP when report-uri is set

https://gerrit.wikimedia.org/r/1008045

Change #1008045 merged by jenkins-bot:

[mediawiki/core@master] Set report-to directive in CSP when report-uri is set

https://gerrit.wikimedia.org/r/1008045

sbassett assigned this task to alistair3149.
sbassett moved this task from Backlog to Done on the ContentSecurityPolicy board.