Client-side reporting
This page performs various actions that result in sending W3C Reporting API reports, triggered through these mechanisms:
- Content security policy (CSP) rule violations
- CSP hash reporting
- Network error logging (NEL)
- Permissions policy violations
- Browser feature and JavaScript code deprecations
- Document policy violations
- Connection-Allowlist
- Microsoft's network-efficiency-guardrails
These JSON reports (with a MIME type of application/reports+json) are sent to URLs and named endpoints defined in the various report-uri and report-to directives, Report-To and Reporting-Endpoints headers, and the default reporting endpoint where there is no means of defining a target.
To allow Connection-Allowlist reports, visit chrome://flags/#connection-allowlist in Chrome to enable the feature flag.
Open your dev console to see the errors, and inspect report submissions in the Chrome developer console in the Application -> Reporting API tab.
This is a non-existent image loaded from another domain that sets an NEL header, so we should expect our browser to send an NEL report for the 404: You will need to visit this site once before the browser knows to send NEL reports to that domain.
This image is displayed much smaller (500px wide) than its native size (2000px wide). This should trigger a Document-Policy violation, which is set to report images that are more than 2.0 x their displayed size, though there is very little browser support for this yet. It should also be caught by Microsoft's network-efficiency-guardrails extension, which is currently only available in Edge:
This image is from a location that's not listed in Connection-Allowlist, so will be blocked and trigger a report.
