csp

Available since Exponential 6.0.15 (in development, not in a release yet).

Summary

The csp module: where browsers send the reports of the Content Security Policy (doc/eng-us/features/6.0/content-security-policy.md, "Reports").

Description

The csp module: where browsers send the reports of the Content Security Policy (doc/eng-us/features/6.0/content-security-policy.md, "Reports").

csp/report takes a report (POST, application/csp-report or application/reports+json) and writes one line per violation to var/log/csp.log; it answers with a status and no body. Browsers send reports without asking anyone to sign in, so the view is open to every visitor (site.ini [SiteAccessSettings] AnonymousAccessList[] and [RoleSettings] PolicyOmitList[] name csp/report) and protects itself: content types, size, rate limits per client and in total, masked and bounded log lines.

Views

Source

kernel/csp/module.php

See also

Help: features/6.0/content-security-policy.md

Generated examples: the views of csp

Generated examples: the policies of csp

Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this module.