Content-Security-Policy-Report-Only - [ HTTP 中文开发手册 ] - 在线原生手册

目录搜索

Guides Access control CORS Authentication Browser detection using the user agent Caching Caching FAQ Compression Conditional requests Connection management in HTTP 1.x Content negotiation Content negotiation: List of default Accept values Cookies CSP Messages Overview Protocol upgrade mechanism Proxy servers and tunneling Proxy servers and tunneling: Proxy Auto-Configuration (PAC) file Public Key Pinning Range requests Redirections Resources and specifications Resources and URIs Response codes Server-Side Access Control Session Guides: Basics Basics of HTTP Choosing between www and non-www URLs Data URIs Evolution of HTTP Identifying resources on the Web MIME Types MIME types: Complete list of MIME types CSP Content-Security-Policy Content-Security-Policy-Report-Only CSP: base-uri CSP: block-all-mixed-content CSP: child-src CSP: connect-src CSP: default-src CSP: font-src CSP: form-action CSP: frame-ancestors CSP: frame-src CSP: img-src CSP: manifest-src CSP: media-src CSP: object-src CSP: plugin-types CSP: referrer CSP: report-uri CSP: require-sri-for CSP: sandbox CSP: script-src CSP: style-src CSP: upgrade-insecure-requests CSP: worker-src Headers Accept Accept-Charset Accept-Encoding Accept-Language Accept-Ranges Access-Control-Allow-Credentials Access-Control-Allow-Headers Access-Control-Allow-Methods Access-Control-Allow-Origin Access-Control-Expose-Headers Access-Control-Max-Age Access-Control-Request-Headers Access-Control-Request-Method Age Allow Authorization Cache-Control Connection Content-Disposition Content-Encoding Content-Language Content-Length Content-Location Content-Range Content-Type Cookie Cookie2 Date DNT ETag Expect Expires Forwarded From Headers Host If-Match If-Modified-Since If-None-Match If-Range If-Unmodified-Since Keep-Alive Large-Allocation Last-Modified Location Origin Pragma Proxy-Authenticate Proxy-Authorization Public-Key-Pins Public-Key-Pins-Report-Only Range Referer Referrer-Policy Retry-After Server Set-Cookie Set-Cookie2 SourceMap Strict-Transport-Security TE Tk Trailer Transfer-Encoding Upgrade-Insecure-Requests User-Agent User-Agent: Firefox Vary Via Warning WWW-Authenticate X-Content-Type-Options X-DNS-Prefetch-Control X-Forwarded-For X-Forwarded-Host X-Forwarded-Proto X-Frame-Options X-XSS-Protection Methods CONNECT DELETE GET HEAD Methods OPTIONS PATCH POST PUT Status 100 Continue 101 Switching Protocols 200 OK 201 Created 202 Accepted 203 Non-Authoritative Information 204 No Content 205 Reset Content 206 Partial Content 300 Multiple Choices 301 Moved Permanently 302 Found 303 See Other 304 Not Modified 307 Temporary Redirect 308 Permanent Redirect 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 405 Method Not Allowed 406 Not Acceptable 407 Proxy Authentication Required 408 Request Timeout 409 Conflict 410 Gone 411 Length Required 412 Precondition Failed 413 Payload Too Large 414 URI Too Long 415 Unsupported Media Type 416 Range Not Satisfiable 417 Expectation Failed 426 Upgrade Required 428 Precondition Required 429 Too Many Requests 431 Request Header Fields Too Large 451 Unavailable For Legal Reasons 500 Internal Server Error 501 Not Implemented 502 Bad Gateway 503 Service Unavailable 504 Gateway Timeout 505 HTTP Version Not Supported 511 Network Authentication Required Status

文字

HTTP Content-Security-Policy-Report-Only响应头允许Web开发人员通过监视（但不强制执行）其效果来实验策略。这些违规报告由通过HTTP 请求发送到指定URI 的JSON文档组成POST。

有关更多信息，另请参阅本文有关内容安全策略（CSP）的文章。

标题类型	响应标题
禁止标题名称	没有

| This header is not supported inside a <meta> element. |

句法

Content-Security-Policy-Report-Only: <policy-directive>; <policy-directive>

指令

Content-Security-Policy标题的指令也可以应用于Content-Security-Policy-Report-Only。

CSP report-uri指令应该与这个标题一起使用，否则这个标题将是一个昂贵的不操作机器。

示例

标题报告可能发生的违规行为。您可以使用它来反复处理您的内容安全策略。您可以观察您的网站的行为，监视违规报告，然后选择Content-Security-Policy标题实施的所需策略。

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

如果您仍然希望接收报告，但也希望强制执行策略，请在report-uri指令中使用Content-Security-Policy标题。

Content-Security-Policy: default-src https:; report-uri /csp-violation-report-endpoint/

违规报告语法

报告JSON对象包含以下数据：

document-uri发生违规的文档的URI。

referrer违规发生的文件的推荐人。

blocked-uri内容安全策略阻止加载的资源的URI。如果阻止的URI来自与document-uri不同的来源，则阻止的URI将被截断以仅包含方案，主机和端口。

violated-directive违反政策部分的名称。

original-policy由Content-Security-PolicyHTTP header.disposition 指定的原始策略根据是否使用Content-Security-Policy标题或Content-Security-Header-Report-Only标题而“enforce”或“reporting” 。

示例违规报告

让我们考虑一个位于http://example.com/signup.html的页面。它使用以下策略，禁止除了样式表之外的所有内容cdn.example.com。

Content-Security-Policy-Report-Only: default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports

HTML的signup.html外观如下所示：

<!DOCTYPE html><html>  <head>    <title>Sign Up</title>    <link rel="stylesheet" href="css/style.css">  </head>  <body>    ... Content ...  </body></html>

你能发现违规行为吗？样式表只允许加载cdn.example.com，但网站尝试从它自己的原点加载一个（http://example.com）。能够执行CSP的浏览器将下列违规报告作为POST请求发送至http://example.com/_/csp-reports访问文档时：

{  "csp-report": {    "document-uri": "http://example.com/signup.html",    "referrer": "",    "blocked-uri": "http://example.com/css/style.css",    "violated-directive": "style-src cdn.example.com",    "original-policy": "default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports",    "disposition": "report"  }}

正如您所看到的，报告包含违规资源的完整路径blocked-uri。这并非总是如此。例如，当signup.html试图从中加载CSS时http://anothercdn.example.com/stylesheet.css，浏览器将不包含完整路径，而只包含origin（http://anothercdn.example.com）。这是为了防止泄露有关跨源资源的敏感信息。

产品规格

规范	状态	评论
内容安全策略3级	编辑草稿	没有变化。
内容安全策略2级	建议	初始定义。

浏览器兼容性

Feature	Chrome	Firefox	Edge	Internet Explorer	Opera	Safari
Basic Support	25	23.0	14	10	15	7

Feature	Android	Chrome for Android	Edge mobile	Firefox for Android	IE mobile	Opera Android	iOS Safari
Basic Support	4.4	(Yes)	(Yes)	23.0	?	?	7.1

另请参阅

Content-Security-Policy

CSP report-uri directive

Content Security in WebExtensions

Display security and privacy policies In Firefox Developer Tools

https://report-uri.io – CSP and HPKP reporting

Hosted CSP reporting for HTTPS migrations