feat(secure-headers): Add CSP report-uri directive support #4527
Description
What is the feature you are proposing?
What is the feature you are proposing?
Add CSP report-uri directive support to secure-headers middleware for backwards compatibility with legacy systems.
Why is this feature needed?
The secure-headers middleware currently supports the modern report-to CSP directive but lacks support for the widely-used report-uri directive. This creates compatibility issues for:
- Legacy systems and older browsers that don't support Reporting API
- Applications migrating from other frameworks that use
report-uri - Enterprise environments with mixed browser support
- Systems where Reporting API isn't available or configured
Without report-uri support, developers cannot use the secure-headers middleware in environments that require legacy CSP violation reporting.
Proposed solution
Add reportUri option to the ContentSecurityPolicy configuration interface and update the CSP header generation logic:
// Type definition addition
interface ContentSecurityPolicyOptions {
// ... existing directives
reportUri?: string | string[]
}
// Usage example
secureHeaders({
contentSecurityPolicy: {
defaultSrc: ["'self'"],
reportUri: '/csp-violation-endpoint'
// or for multiple endpoints:
reportUri: ['/endpoint1', '/endpoint2']
}
})