Skip to content

CSP report-only working on firefox only?

i’m trying to receive csp reports for my magento2 (open-source) website using their official guide:
https://developer.adobe.com/commerce/php/development/security/content-security-policies/

and using an endpoint generated from report-uri.com

this is config.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
    <default>
        <csp>
            <mode>
                <storefront>
                    <report_only>1</report_only>
                     <report_uri>https://*mysubdomain*.report-uri.com/r/d/csp/reportOnly</report_uri>
                </storefront>
                <admin>
                    <report_uri>https://*mysubdomain*.report-uri.com/r/d/csp/reportOnly</report_uri>
                    <report_only>1</report_only>
                </admin>
            </mode>
        </csp>
    </default>
</config>

and then i created a csp_whitelist.xml as well.

I can see the reports being generated correctly in the report-uri dashboard ONLY when i’m navigating on firefox.

I tried doing the same with Chrome and Opera but neither work. I looked into the headers and the endpoint is being correctly set up in Content-Security-Policy-Report-Only like this:

report-uri https://*mysubdomain*.report-uri.com/r/d/csp/reportOnly/; report-to report-endpoint;

here’s the report-uri dashboard:
report-uri dashboard showuing only firefox reports

Can anyone tell me why reports are only working on firefox?