Client-side reporting
This page performs various actions that result in sending W3C Reporting API reports, triggered through these mechanisms:
- Content security policy (CSP) rule violations
- CSP hash reporting
- Network error logging (NEL)
- Permissions policy violations
- Browser feature and JavaScript code deprecations
- Document policy violations
- Connection-Allowlist
- Microsoft's network-efficiency-guardrails
These JSON reports (with a MIME type of application/reports+json) are sent to URLs and named endpoints defined in the various report-uri and report-to directives, Report-To and Reporting-Endpoints headers, and the default reporting endpoint where there is no means of defining a target.
Open your dev console to see the errors, and inspect report submissions in the Chrome developer console in the Application -> Reporting API tab.
This is a non-existent image loaded from another domain that sets an NEL header, so we should expect our browser to send an NEL report for the 404: You will need to visit this site once before the browser knows to send NEL reports to that domain.
This image is displayed much smaller (500px wide) than its native size (2000px wide). This should trigger a Document-Policy violation, due to the presence of Microsoft's network-efficiency-guardrails extension, though this is currently only available in Edge 146+:
This image is from a location that's allowed in CSP, but not listed in Connection-Allowlist, so it will be blocked and trigger a report (in Chrome 152 and later):
