Changes

Reports The report body MUST be an XML document containing a JSON object having the following fieldsproperties:

Violation Report XML SchemaJSON Format:

<?xml version="1.0" encoding="ISO-8859-1" ?> <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">{ <xs:element name="csp-report">: { <xs:complexType> <xs:sequence> <xsrequest:element name="request" type="string" use=GET /index.html HTTP/1.1"required" />, <xs:element name=" request-headers: " type="string" />Host: example.com <xs User-Agent:element name=... ...", blocked-uri: " type=..."string" />, <xs:element name=" violated-directive" type="string" use="required" /> <xs:element name="original-policy" type="string" use="required..." /> </xs:sequence> </xs:complexType> </xs:element>} </xs:schema>}

 The MIME type of the transmitted report will be set to <tt>application/xmljson</tt>.

In this example, a page located at <tt>http://example.com/index.html</tt> was requested using HTTP 1.1 via the GET method. It provided a policy that included the directive "<tt>img-src 'self'</tt>", which was violated by a request for <tt><nowiki>http://evil.com/some_image.png</nowiki></tt>. The sample XML data JSON object sent to the policy-specified <tt>report-uri</tt> follows.

<{ "csp-report>": { < "request>": "GET http://index.html HTTP/1.1</request>", < "request-headers><![CDATA[ ": "Host: example.com User-Agent: Mozilla/5.0 (X11Macintosh; U; Linux i686Intel Mac OS X 10.5; en-US; rv:1.9.3a5pre) Gecko/2008061015 Firefox20100601 Minefield/3.07a5pre Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300115 Connection: keep-alive", ]]></request-headers> < "blocked-uri>": "<nowiki>http://evil.com/some_image.png</nowiki></blocked-uri>", < "violated-directive>": "img-src 'self</violated-directive>'", < "original-policy>": "allow 'none'; img-src *, allow 'self'; img-src 'self</original-policy>'" } </csp-report>}