How to setup my reporting endpoint?

Why Use Security Reporting?

The Challenge of Browser Configurations

• Browser Differences: Different browsers may interpret and enforce security policies differently. What works in your testing browser might fail in others.
• User Configurations: Users have different extensions, settings, and configurations that can affect how security policies are enforced. Testing every possible combination locally is impractical.
• Device Variations: Your users access your site from various devices and browser versions - each potentially handling security policies differently.

Understanding Benefits of CSP Reporting

• Browser-specific implementation differences
• Conflicts with popular browser extensions
• Issues on devices or configurations you don't have access to
• Real-world usage patterns that differ from testing environments

Report-URI vs Report-To

Report-URI

Content-Security-Policy: 
  default-src 'self'; 
  report-uri https://report.centralcsp.com/<your-endpoint>

Reporting-Endpoints

Reporting-Endpoints: csp-endpoint="https://report.centralcsp.com/<your-endpoint>

Content-Security-Policy: default-src 'self'; report-to csp-endpoint

Report-To

Report-To: {"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://report.centralcsp.com/<your-endpoint>"}]}

Implementing Security Reporting with CentralCSP

1. Sign up for CentralCSP
   • Create an account at CentralCSP
   • Get your unique reporting endpoint
2. Configure Your Headers Using CentralCSP's dashboard, you can generate the appropriate headers for your application:
   Copy

   Content-Security-Policy: 
      default-src 'self';
      script-src 'self' 'report-sample';
      style-src 'self';
      img-src 'self';
      font-src 'self';
      object-src 'none';
      base-uri 'none';
      form-action 'none';
      frame-ancestors 'none';
      frame-src 'self';
      connect-src 'none';
      upgrade-insecure-requests;
      report-uri https://report.centralcsp.com/<myendpoint>;
   

3. Start with Report-Only Mode Begin with a strict policy in report-only mode to collect violation reports without blocking any content:
   Copy

   Content-Security-Policy-Report-Only:
    default-src 'self';
    script-src 'self' 'nonce-1234567890';
    style-src 'self' 'nonce-1234567890';
    img-src 'self';
    connect-src 'none';
    frame-src 'self';
    form-action 'self';
    frame-ancestors 'self';
    object-src 'none';
    base-uri 'self';
    report-uri https://report.centralcsp.com/<your-endpoint>;

4. Analyze Reports CentralCSP provides a comprehensive dashboard where you can:
   • View real-time security violations
   • Analyze patterns and trends
   • Get detailed insights about potential security issues
   • Export reports for compliance purposes
   • Get insight about what you need to do to fix the issues & improve your security

How is CSP reporting working?

1. The client browser requests your website from the server
2. Your server responds with the page and CSP policy
3. When the browser attempts to load a resource (script, image, etc.)
4. The browser checks if the resource is allowed by your CSP rules
5. If not allowed, the browser blocks the resource and sends a violation report
6. These reports are collected, stored, and made available through a dashboard

Get Started with Central CSP

How to see the reports collected?

Dashboard showing blocked origins that need CSP adjustments

• Identify which origins are being blocked by your CSP
• Determine which blocked resources are legitimate and needed by your website
• Make informed decisions about adjusting your CSP rules
• Track violation patterns over time to improve your security posture

How to see more details about a violation?

Detailed view of CSP violations showing frequency and location data

• Count violations per blocked resource
• See which pages have violations
• Understand violation context
• Identify patterns to prioritize fixes
• Make data-driven CSP rule adjustments
• Monitor security improvements over time

How to see all the policies used by your website?

Dashboard showing all Content Security Policies implemented on your website

• View all active policies on your website
• Identify gaps in your security coverage
• Track policy changes over time
• Understand which directives are being used
• Make informed decisions about policy adjustments

Testing Your CSP Implementation

• Analyze your current CSP configuration
• Identify potential security gaps
• Get recommendations for improvement
• Test policy effectiveness

Results of the CSP Scanner

Example: Analytics Violations

{
"csp-report": {
  "document-uri": "https://example.com/page",
  "referrer": "https://google.com",
  "violated-directive": "connect-src 'self'",
  "blocked-uri": "https://region1.google-analytics.com",
  "line-number": 123,
  "column-number": 45
}
}

• ✓ This is a legitimate resource our website needs
• ✓ It's a known Google Analytics endpoint
• ✓ Multiple users are affected by this violation

Content-Security-Policy-Report-Only: 
  default-src 'self';
  connect-src 'self' https://region1.google-analytics.com;
  // ... rest of your policy ...

Best Practices for Security Reporting

1. Start with Monitoring Mode
   • Begin with CSP in report-only mode
   • Analyze violations without blocking content
   • Gradually enable enforcement based on findings
2. Regular Review
   • Check reports daily
   • Address high-priority issues immediately
   • Update policies based on legitimate violations
3. Careful Review Required
   • Not every blocked resource should be added to your CSP
   • Violations might come from browser extensions
   • Always investigate the source and purpose of blocked resources

Moving to Enforcement Mode

Content-Security-Policy: 
    default-src 'self';
    script-src 'self' https://trusted-scripts.com 'nonce-1234567890';
    style-src 'self' https://trusted-styles.com 'nonce-1234567890';
    img-src 'self' https://trusted-images.com;
    connect-src 'self' https://api.trusted-service.com;
    frame-src 'self' https://trusted-frame.com;
    frame-ancestors 'self';
    form-action 'self';
    object-src 'none';
    base-uri 'self';
    report-uri https://report.centralcsp.com/<your-endpoint>;

Continuous Monitoring

• Regularly review violation reports to ensure your policy remains effective
• Investigate unexpected blockages promptly to minimize disruption
• Update your policy as your website evolves and new resources are added

Conclusion

• Start with monitoring mode
• Regularly review reports
• Update policies based on findings
• Use CentralCSP's advanced features for better insights