Reporting-Endpoints
The Reporting API delivers CSP violations, deprecation warnings, crash reports, and permissions-policy violations to endpoints you name here. The value is a structured dictionary of name="url" pairs; other headers then reference a name — most importantly CSP's report-to default. This is the modern replacement for the Report-To header (a JSON blob) and for CSP's report-uri; keep report-uri alongside report-to for now, since coverage differs between browsers. Reports are POSTed as application/reports+json, batched, so the endpoint must be HTTPS and must tolerate bursts. Naming an endpoint you don't actually operate is worse than sending nothing. MDN
Options
| Option | Type | Default | Notes |
|---|---|---|---|
name | text | default | CSP’s `report-to` directive refers to this name. "default" also catches reports that name no group. |
url | text | (empty) | Must be HTTPS. Leave blank and the header is omitted — an endpoint you don’t operate is worse than none. |
Scoring
Contributes up to 1 point to your grade (a bonus header — not required for an A+).