controller_csp_report

Controller handling Content-Security-Policy reports.

Set in the report-to header of your Content-Security-Policy the URL to this controller to receive reports about policy violations.

Reports whose blocked URL or source file uses a known browser extension scheme are ignored. Inline and eval violations without an extension URL are retained, as they cannot reliably be distinguished from site violations.

Accepted reports are forwarded with z_notifier:notify_sync/2 as #content_security_report{} notifications. Modules can export observe_content_security_report/2 or pid_observe_content_security_report/3 to receive them. See zotonic_observer:observe_content_security_report/2 for the fields, delivery semantics and validation requirements.