Aligning external reporting group name across Stott's CSP and middleware-delivered policy headers

[demonHunter10]

Hi Mark,

Thanks for the module, it's doing the heavy lifting for CSP on an Optimizely
CMS 12 build I'm running. I'm adding a set of newer report-only policy headers
that Stott's doesn't emit natively (Integrity-Policy-Report-Only,
Document-Policy-Report-Only, COOP/COEP-Report-Only, Permissions-Policy-Report-Only,
and NEL) via a small piece of custom middleware, and pointing them at the same
external reporting provider Stott's CSP reports to.

To avoid duplicate or conflicting headers, my plan is to let Stott's stay the sole
authority for the CSP and the Reporting-Endpoints / Report-To headers, and have the
middleware only emit the extra policy headers, each referencing the same reporting
group Stott's already defines. That way there's one group definition and no second
Reporting-Endpoints header.

Three things I'd like to confirm before I build against them:

1. Reporting group name. When "Use External Reporting Endpoints" is on, what group
   name does the emitted Reporting-Endpoints / Report-To header use? Is it fixed
   (I've seen "stott-security-endpoint" in examples), or is it configurable? If I
   can rename it, my middleware headers can reference a shared name cleanly; if it's
   fixed, I'll reference that fixed name instead.

2. report-uri. Does the current version still emit the report-uri directive in the
   CSP alongside report-to? I want to keep Firefox/Safari coverage and need to know
   whether that fallback comes from Stott's or whether I should add it myself.

3. Both v0 and v1. Does the module emit both Reporting-Endpoints (v1) and Report-To
   (v0)? NEL needs the group present in the v0 Report-To header specifically, so I'm
   checking whether Stott's covers that or whether the middleware should own Report-To.

Longer term, is native support for any of those report-only policy headers on the
roadmap, or would you be open to a PR? Happy to contribute if there's a shape you'd
want it in.

Appreciate any pointers.

Sherwin

[GeekInTheNorth]

Hello @demonHunter10

1. Reporting group name. When "Use External Reporting Endpoints" is on, what group name does the emitted Reporting-Endpoints / Report-To header use? Is it fixed (I've seen "stott-security-endpoint" in examples), or is it configurable? If I can rename it, my middleware headers can reference a shared name cleanly; if it's fixed, I'll reference that fixed name instead.

Group names are fixed, not configurable. CspService hard-codes two groups. Internal reporting emits the group stott-security-endpoint pointing at the addon's own violation endpoint. External reporting emits stott-security-external-endpoint pointing at the URL from "External Report-To Endpoint". Middleware that wants to share the external group should reference stott-security-external-endpoint. There is no setting to rename either group. This is something I could add to the backlog, but it is the first time it's been requested.

2. report-uri. Does the current version still emit the report-uri directive in the CSP alongside report-to? I want to keep Firefox/Safari coverage and need to know whether that fallback comes from Stott's or whether I should add it myself.

Interestingly, I did support Report-Uri up until version v3.0.2 when it was removed. I noted some browsers were just sending report-uri payloads to the report-to end point instead of matching the report-to schema as part of getting off of the deprecated report-uri. This meant I had to do a lot of refactoring of the functionality. Report-Uri shouldn't really be around anymore, but I can look to reintroduce this.

3. Both v0 and v1. Does the module emit both Reporting-Endpoints (v1) and Report-To (v0)? NEL needs the group present in the v0 Report-To header specifically, so I'm checking whether Stott's covers that or whether the middleware should own Report-To.

Any additional header that is not on the Add-ons reserved list can actually be added without creating a middleware by adding a custom header into the Response Headers feature. This functionality was added in v5 which is CMS 12 compatible, you can read more in the Release Notes and my blog Announcing Stott Security Version 5.0

I will take your suggestions for new report only headers into account and look to draft up some stories for delivery.

Longer term, is native support for any of those report-only policy headers on the roadmap, or would you be open to a PR? Happy to contribute if there's a shape you'd want it in.

I'm happy to add new features to the road map and to accept pull requests to introduce them. Do feel free to fork the repository and raise a pull request. Please note, that as you are developing for a client on CMS 12, if you did want to raise a PR, you would need to branch from main-cms12 which is where I am maintaining CMS 12 updates.