The HTTP Content-Security-Policy report-to (and the deprecated report-uri) response header directive instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.
This Rust crate is an endpoint to receive those reports and send them to an email address.
First, install using cargo. You must choose the channels you want to receive notifications on, using the --features command line arg.
mail and sentry are currently available.
cargo install morbo --features=mail,sentry
Then, setup some environment variables:
``` MORBOMAILERFROMNAME=Example MORBOMAILERFROMEMAIL=example@example.org MORBOMAILERTONAME=Example MORBOMAILERTOEMAIL=example@example.org MORBOMAILERSMTPHOSTNAME=localhost MORBOMAILERSMTPPORT=1025 MORBOMAILERSMTPUSERNAME= MORBOMAILERSMTPPASSWORD=
MORBOSENTRYDSN= ```
morbo --port=8080 # (port is optionnal, default 8080)
Then, setup a reverse proxy in your webserver. For example, in nginx:
location /_/csp-reports {
proxy_pass http://127.0.0.1:8080;
}
In the website you want to report CPS, set the following headers:
Report-To: {"group": "csp-endpoint","max_age": 10886400,"endpoints": [{ "url": "http://example.org/_/csp-reports" }]});
Content-Security-Policy: default-src 'self'; report-to csp-endpoint; report-uri http://example.org/_/csp-reports;');
Event though report-uri is deprecated, report-to is not supported in every browser.