Skip to content

COEP/CORP report-to incorrect and can we have a name for the reporting body object? #11365

Open
@hamishwillee

Description

@hamishwillee
  1. https://html.spec.whatwg.org/#coop-report-to and https://html.spec.whatwg.org/#coep-report-to state this for report-to

    The valid token values are the opener policy values. The token may also have attached parameters; of these, the "report-to" parameter can have a valid URL string identifying an appropriate reporting endpoint. [REPORTING]

    The value expected by the reporting API is not an URL string, but rather an endpoint as defined (and sent separately) in https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints

  2. The reporting API defines specific objects for the report body - such as CSPViolationReportBody. Would it be possible for the HTML spec to similarly define an object name. It's a convenience for MDN documentation and compatibility data updates in future if the body changes, and also convenient for linking to the spec in our docs. Further, defining the IDL means that it is clear we're deriving from ReportBody - otherwise this is a guess.

    FYI, for the docs I am currently naming these COEPViolationReportBody and COOPViolationReportBody

Note that https://web.dev/articles/coop-coep states that the above is how things work on browsers and my testing seems to back that up.

This issue comes out of the MDN docs discussion here: mdn/content#39814

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions