#5143 - CSP: request-uri is deprecated

By PDStig
Added 14th Dec 2022, 4:05 AM
8 views

Identifier	#5143
Issue type	Feature request or suggestion
Title	CSP: request-uri is deprecated
Status	Open
Handling member	Deleted
Addon	core
Description	The request-uri directive in CSP, which is what we are using, is deprecated. Use report-to instead. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri
Steps to reproduce
Funded?	No

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated

Comments

By Guest posted 15th Dec 2022, 11:32 AM

All browsers support CSP's request-uri, but Firefox doesn't support the Reporting API which report-to depends on. It's been behind a flag for years, and now isn't even available behind a flag because the implementation is outdated (https://bugzilla.mozilla.org/show_bug.cgi?id=1775194).

So makes sense to hold off on this.

By Guest posted 15th Dec 2022, 11:34 AM

I've disabled CSP reporting for regular users via https://gitlab.com/composr-foundation/composr/-/commit/65ec77311484d4404d1c9b143f6dbec2eac3fabc so to avoid console errors.

#5143 - CSP: request-uri is deprecated

Rating

Comments

Statistics