Ability to set both "report-uri" AND "report-to"

[OwenMelbz]

Hi,

Recently report-uri has been deprecated - however it's still recommended to provide a URL for this field for older browsers.

However browsers like Chrome are now only using the report-to which defines a group within a new Report-To response header.

Currently the code just runs $compiled []= 'report-to ' . $this->policies['report-uri'] . '; ';

This means the value is always the same for both.

Would it be possible to allow individual control for the report-to directive? this way we can leave a URL for older browsers in the report-uri section and then have a group name in the report-to directive? e.g. something maybe like:

if (empty($this->policies['report-to'])) {
    $compiled []= 'report-to ' . $this->policies['report-uri'] . '; ';
}

Then if the developer defines a report-to it will allow it?

[iangcarroll]

Fixed in #42!