Re: [CSP] Additional report field: report-only: "true|false"

I think the separate report URIs (via extra params or different end points)
is the easier option here.


On 25 June 2014 20:33, Neil Matatall <neilm@twitter.com> wrote:

> I'd like to propose adding a new field to the CSP reports: report-only.
>
> It's [arguably] valuable to know whether or not the policy was
> enforced when a given violation report is generated. Sometimes
> policies are enforced for a percentage or defined subset of users (or
> not at all), but there is no way to determine this from the report
> without "smuggling" params in the report-uri.
>
> As you can probably tell, I'm not entirely convinced this is even
> worth while (like my status code proposal).
>
>