Skip to content

Commit 2f51304

Browse files
authored
Use report-to with group which configured in the separate header (#9440)
1 parent a2b6adc commit 2f51304

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

docs/product/security-policy-reporting.mdx

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ To configure CSP reports in Sentry, you’ll need to send a header from your ser
1919
```
2020
Content-Security-Policy: ...;
2121
report-uri https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___;
22-
report-to {"group":"default","max_age":10886400,"endpoints":[{"url":"https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___"}],"include_subdomains":true}
22+
report-to csp-endpoint
23+
24+
Report-To: {"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___"}],"include_subdomains":true}
2325
```
2426

2527
<Alert level="note" title="Compatibility Recommendation">
@@ -35,7 +37,9 @@ Alternatively you can setup CSP reports to simply send reports rather than actua
3537
```
3638
Content-Security-Policy-Report-Only: ...;
3739
report-uri https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___;
38-
report-to {"group":"default","max_age":10886400,"endpoints":[{"url":"https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___"}],"include_subdomains":true}
40+
report-to csp-endpoint
41+
42+
Report-To: {"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___"}],"include_subdomains":true}
3943
```
4044

4145
When defining your policy it is important to ensure that `sentry.io` or your self-hosted Sentry domain is in your `default-src` or `connect-src` policy, or browsers will block requests that submit policy violations.

0 commit comments

Comments
 (0)