如何测试 CSP 报告 uri 端点？

Question

I've added a Content Security Policy to my website and made a report-uri endpoint with AWS API Gateway, Lambda, and DynamoDB. I've tested it with Postman using the following JSON

{
      "resource": "/",
      "path": "/",
      "requestContext": {
        "resourcePath": "/",
        "httpMethod": "POST",
        "path": "/latest"
      },
      "headers": {
        "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
        "accept-encoding": "gzip, deflate, br",
        "Host": "70ixmpl4fl.execute-api.us-east-2.amazonaws.com",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36",
        "X-Amzn-Trace-Id": "Root=1-5e66d96f-7491f09xmpl79d18acf3d050"
      },
      "multiValueHeaders": {
        "accept": [
          "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
        ],
        "accept-encoding": [
          "gzip, deflate, br"
        ]
      },
      "queryStringParameters": null,
      "multiValueQueryStringParameters": null,
      "pathParameters": null,
      "stageVariables": null,
      "body": {
        "csp-report": {
          "document-uri": "https://example.com/signup.html",
          "referrer": "",
          "blocked-uri": "https://example.com/css/style.css",
          "violated-directive": "style-src cdn.example.com",
          "original-policy": "default-src 'none'; style-src cdn.example.com; report-uri /_/csp-reports"
        }
      },
      "isBase64Encoded": false
    }

It seems to work properly when using Postman. But when I added the endpoint to my Content Security Policy and attempt to violate the policy, I can't seem to get it to report correctly.

Does the JSON above adequately demonstrate what a real CSP violation would look like? I've looked around and haven't seen much about developing your own endpoint. Any resources or other advice is greatly appreciated.

Answer 1

It depends on the browser

1. some browser sends the Json and CSP violation report some sends thec csp-report.
2. Few browser sends the request base64 encoded.
3. Specifically in chrome browser it sends base64 encoded and as Json format. In your payload.

Hopefully it answers your question.