demo · v137

IP Address Logging in Reports

The Reporting API gains an opt-in ip_address: true setting per endpoint. Reports posted to that endpoint now include the client IP — letting sites correlate CSP / NEL / deprecation reports back to the server logs that produced them. Trigger a CSP violation below to see exactly what your browser would queue.

Heads upReports ship server-side (out of band). This page captures a CSP violation event in-DOM so you can see the payload shape; the actual ip field is appended by the browser when it serialises the report for the server.
probing…

Reporting-Endpoints header (server-side)

Reporting-Endpoints: csp-endpoint="https://example.com/r"; ip_address = true Content-Security-Policy: script-src 'self'; report-to csp-endpoint

captured violation event

no event yet — click trigger above
click trigger to fire a CSP violation

the code

// Server (HTTP/1.1):
Reporting-Endpoints: csp-endpoint="https://reports.example.com/r"; ip_address=true
Content-Security-Policy: script-src 'self'; report-to csp-endpoint

// Client just observes — the browser POSTs the report (now with "ip"):
document.addEventListener("securitypolicyviolation", (e) => { /* mirror in UI */ });

see also