You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The `PermissionsPolicyViolationReport` dictionary of the [Reporting API](/en-US/docs/Web/API/Reporting_API) represents a report that is generated when a document violates its [Permissions Policy](/en-US/docs/Web/HTTP/Guides/Permissions_Policy).
13
13
14
-
Reports of this type can be observed from within a page using a {{domxref("ReportingObserver")}}, and a serialized version can be sent to a reporting endpoint server.
14
+
Reports of this type can be observed from within a page using a {{domxref("ReportingObserver")}}, and a serialized version can be sent to a reporting server endpoint.
15
15
16
16
## Instance properties
17
17
@@ -52,7 +52,7 @@ Violations of the policy may also be reported but not enforced using the {{httph
52
52
You can monitor for Permissions-Policy violation reports within the page that sets the policy using the [Reporting API](/en-US/docs/Web/API/Reporting_API).
53
53
To do this you create a {{domxref("ReportingObserver")}} object to listen for reports, passing a callback method and an (optional) `options` property specifying the types of reports that you want to report on.
54
54
The callback method is then called with reports of the requested types, passing a report object.
55
-
For `Permissions-Policy` or `Permissions-Policy-Report-Only` violations, the object will be a `PermissionsPolicyViolationReport` instance with `PermissionsPolicyViolationReport.type == "permissions-policy-violation"`.
55
+
For `Permissions-Policy` or `Permissions-Policy-Report-Only` violations, the object will be a `PermissionsPolicyViolationReport` instance with `PermissionsPolicyViolationReport.type === "permissions-policy-violation"`.
56
56
57
57
The structure of a typical in-page report is shown below.
58
58
Note that we can see the URL of the page that had its policy violated (`url`), and from `body.featureId` we can see which feature was blocked.
@@ -167,7 +167,7 @@ Note that the `type` is `"permissions-policy-violation"` and `body.featureId` id
167
167
This example shows how to configure reporting of `Permissions-Policy` violations to a server endpoint.
168
168
169
169
The response headers below block geolocation and define the reporting endpoint name for the feature as "geo_endpoint".
170
-
The {{HTTPHeader("Reporting-Endpoints")}} HTTP response header is used to define URL of this endpoint name.
170
+
The {{HTTPHeader("Reporting-Endpoints")}} HTTP response header is used to define the URL of this endpoint name.
Copy file name to clipboardExpand all lines: files/en-us/web/api/reporting_api/index.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,7 +31,7 @@ There are several different features and problems on the web platform that gener
31
31
32
32
The purpose of the Reporting API is to provide a consistent reporting mechanism that can be used to make such information available to developers in the form of reports represented by JavaScript objects.
33
33
34
-
Reports can be obtained within a page using JavaScript via reporting observers, or can be sent to a remote server endpoint.
34
+
Reports can be retrieved via JavaScript reporting observers or sent to a remote server endpoint.
35
35
The types of reports and the two reporting approaches are detailed in the sections below.
36
36
37
37
### Report types
@@ -43,12 +43,12 @@ The type of report can be determined from its `type` property, which for the rep
43
43
Reports sent to reporting endpoints and reporting observers are essentially the same.
44
44
The only difference is that server reports are JSON serializations of the objects that have additional `user_agent` and `age` fields.
45
45
46
-
A list of documented report types and their corresponding report dictionary are given in the [`options.types`](/en-US/docs/Web/API/ReportingObserver/ReportingObserver#types) parameter passed to the `ReportingObserver()` constructor.
46
+
A list of documented report types and their corresponding report dictionaries is given in the [`options.types`](/en-US/docs/Web/API/ReportingObserver/ReportingObserver#types) parameter passed to the `ReportingObserver()` constructor.
47
47
48
48
### Reporting observers
49
49
50
50
Reports can be obtained via {{domxref("ReportingObserver")}} objects created via JavaScript inside the website you are aiming to get reports on.
51
-
This method is not as failsafe as sending reports to the server because any page crash could stop you retrieving the reports — but it is easier to set up, and more flexible.
51
+
This method is not as failsafe as sending reports to the server because any page crash could stop you from retrieving the reports; it is, however, easier to set up, and more flexible.
52
52
53
53
A `ReportingObserver` object is created using the {{domxref("ReportingObserver.ReportingObserver", "ReportingObserver()")}} constructor, which is passed two parameters:
54
54
@@ -69,10 +69,10 @@ Reports sent to endpoints can be retrieved independently of the running of the w
69
69
> There is no absolute guarantee of report delivery — a report could still fail to be collected if a serious error occurs.
70
70
71
71
The {{httpheader("Reporting-Endpoints")}} HTTP header is used to specify the name and URL for different endpoints that a user-agent has available to it for delivering reports.
72
-
The endpoints can then be used on particular HTTP response headers to indicate the specific endpoint (or in some cases endpoints) that will be used for the associated report.
72
+
The endpoints can then be specified within particular HTTP response headers to indicate the endpoint (or in some cases, endpoints) that associated reports will be delivered to.
73
73
Report types that don't have an associated HTTP header, such as `crash`, `deprecation`, and `intervention` reports, will usually send reports to the [`"default"` reporting endpoint](/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints#default_reporting_endpoint) (this is just an endpoint named "default" specified using the `Reporting-Endpoints` header).
74
74
75
-
The mechanism to specify server endpoint for each report is listed below.
75
+
The mechanism to specify server endpoints for each report is listed below.
76
76
77
77
-`coep`
78
78
-`report-to` parameter on {{HTTPHeader("Cross-Origin-Embedder-Policy")}} or {{HTTPHeader("Cross-Origin-Embedder-Policy-Report-Only")}}
Copy file name to clipboardExpand all lines: files/en-us/web/http/reference/headers/permissions-policy-report-only/index.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,12 +12,12 @@ sidebar: http
12
12
{{SeeCompatTable}}
13
13
14
14
The HTTP **`Permissions-Policy-Report-Only`** {{Glossary("response header")}} provides a mechanism for website administrators to report on violations of a {{HTTPHeader("Permissions-Policy")}} without enforcing them.
15
-
This allows testing and fixing of a [Permissions Policy](/en-US/docs/Web/HTTP/Guides/Permissions_Policy) issues before a policy is deployed.
15
+
This allows testing and fixing of [Permissions Policy](/en-US/docs/Web/HTTP/Guides/Permissions_Policy) issues before a policy is deployed.
16
16
17
17
The syntax and behavior is exactly the same as for `Permissions-Policy` except:
18
18
19
19
- The policy is not enforced.
20
-
- Policy violation report objects ({{domxref("PermissionsPolicyViolationReport")}}) have the value `body.disposition="report"`(instead of `"enforce"`).
20
+
- Policy violation report objects ({{domxref("PermissionsPolicyViolationReport")}}) have a `body.disposition` value of `"report"` instead of `"enforce"`.
21
21
22
22
See {{HTTPHeader("Permissions-Policy")}} for more information (most of its content has not been duplicated below).
By specifying `geolocation=()` for the origin list, it is violation to access geolocation for all browsing contexts (this includes all `<iframe>`s), regardless of their origin.
58
+
By specifying `geolocation=()` for the origin list, it is a violation for any browsing context to access geolocation (this includes `<iframe>`s), regardless of origin.
59
59
The `report-to` parameter indicates that reports will be sent to the endpoint named `geo_endpoint`.
60
60
The mapping between `geo_endpoint` and the URL where reports are to be sent is provided in `Reporting-Endpoints`.
The [report payload](/en-US/docs/Web/API/Reporting_API#reporting_server_endpoints) sent to the endpoint might look like the JSON below.
71
+
The [report payload](/en-US/docs/Web/API/Reporting_API#reporting_server_endpoints) sent to the endpoint will have the same structure as the JSON sample shown below.
72
72
This is the same as a report for `Permissions-Policy` except for the value of `body.disposition`.
73
73
74
74
```json
@@ -77,7 +77,7 @@ This is the same as a report for `Permissions-Policy` except for the value of `b
77
77
"age": 48512,
78
78
"body": {
79
79
"columnNumber": 29,
80
-
"disposition": "report", // A violation that is reported and not enforced
80
+
"disposition": "report", // A violation that is reported but not enforced
81
81
"lineNumber": 44,
82
82
"message": "Permissions policy violation: geolocation access has been blocked because of a permissions policy applied to the current document.",
The header can be used to set the allowlists for one or more directives, and optionally a per-directive `report-to` parameter indicating the server endpoint for reporting violations of the policy.
45
+
The header can be used to set the allowlists for one or more directives, and optionally a per-directive `report-to` parameter indicating the server endpoint to send policy violation reports to.
46
46
The entries for each directive are comma separated.
0 commit comments