[webappsec] Including URI fragment in CSP reports (ACTION-43)

On our last WG call, we raised the issue of URI fragments in CSP reports.   Currently, the specification calls for the "HTTP request line of the protected resource whose policy was violated including method, URI and HTTP version".  This would exclude URI fragments as they are not sent with the request, but processed locally in the User-Agent.  This appears to be correct behavior, as fragments are sometimes used for private context and should not leak, especially in non-same-origin reports.

I would like to propose that the spec be amended to explicitly forbid the sending of URI fragments as a clarification.  Are we aware of any cases where this prohibition would negatively impact the usefulness of the reports?

Brad Hill