{"result":{"depiction_url":null,"edges":{"subject":{"objects":[{"created":"2026-09-09T13:47:32Z","object_id":{"id":2555,"is_a":["categorization","keyword","keyword_information_type"],"name":"zotonic_topic_reference","title":"Reference","uri":"https:\/\/zotonic.com\/id\/2555"},"seq":1},{"created":"2026-09-09T13:47:32Z","object_id":{"id":2564,"is_a":["categorization","keyword","keyword_audience"],"name":"zotonic_topic_backend_developer","title":"Backend developer","uri":"https:\/\/zotonic.com\/id\/2564"},"seq":2},{"created":"2026-09-09T13:47:32Z","object_id":{"id":2627,"is_a":["categorization","keyword","keyword_architecture"],"name":"zotonic_topic_notification","title":"Notification","uri":"https:\/\/zotonic.com\/id\/2627"},"seq":3},{"created":"2026-09-09T13:47:32Z","object_id":{"id":2676,"is_a":["categorization","keyword","keyword_technology"],"name":"zotonic_topic_http","title":"HTTP","uri":"https:\/\/zotonic.com\/id\/2676"},"seq":4},{"created":"2026-09-09T13:47:32Z","object_id":{"id":2685,"is_a":["categorization","keyword","keyword_quality"],"name":"zotonic_topic_security","title":"Security","uri":"https:\/\/zotonic.com\/id\/2685"},"seq":5}],"predicate":{"id":308,"is_a":["meta","predicate"],"name":"subject","title":{"_type":"trans","tr":{"en":"Keyword"}},"uri":"http:\/\/purl.org\/dc\/elements\/1.1\/subject"}}},"id":2517,"is_a":["text","documentation","reference","notification"],"links":[{"rel":"self","target":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/2517"},{"rel":"hub","target":"https:\/\/zotonic.com\/.zotonic\/websub"}],"medium":null,"medium_url":null,"name":"doc_notification_content_security_report","page_url":{"en":"https:\/\/zotonic.com\/docs\/2517\/observe_content_security_report-2","x-default":"https:\/\/zotonic.com\/docs\/2517\/observe_content_security_report-2"},"preview_url":null,"resource":{"version":109,"pivot_location_lat":null,"title":"observe_content_security_report\/2","is_authoritative":true,"body":"

Handle a content security report<\/p>\n

Type:<\/p>\n

notify_sync<\/a><\/p>\n

controller_csp_report<\/code> forwards each accepted Reporting API CSP violation using\nz_notifier:notify_sync\/2<\/code>. It checks that the request origin (or the Referer when\nthe origin is null<\/code>) and the report URL are HTTPS URLs belonging to the site.\nThe report must have type csp-violation<\/code> and a map as its body.<\/p>\n

Reports with a blockedURL<\/code> or sourceFile<\/code> using safari-extension:<\/code>,\nsafari-web-extension:<\/code>, chrome-extension:<\/code>, moz-extension:<\/code> or\nms-browser-extension:<\/code> are ignored before notification delivery. Inline and eval\nviolations without an identifiable extension URL are still forwarded.<\/p>\n

Export observe_content_security_report\/2<\/code> in an active module to receive reports,\nor pid_observe_content_security_report\/3<\/code> for an observer that also receives the\nmodule process PID. Observer functions run synchronously in the request process;\ntheir return values are ignored. Keep handling brief or delegate expensive work\nto a worker. mod_logging<\/code> uses the PID observer to store reports for the admin log.<\/p>\n

All report data is browser-supplied and untrusted. The url<\/code> is checked for site\nmembership, but is not escaped for output. The body is passed through unchanged:\nvalidate field types and sanitize or escape data before storing or displaying it.\nThe origin and URL checks do not authenticate the sender.<\/p>\n

#content_security_report{}<\/code> properties:<\/p>\n