CSP violation reportsBaseline · Newly available
CSP violation reporting sends a report to a URL nominated by the Reporting-Endpoints header or the ReportingObserver API when a page violates its content security policy.
Works in the latest version of every major browser, but older devices may not support it yet. Baseline since Mar 24, 2026.
Browser support
DesktopChrome
1–73Not supported
74+Supportedsince Apr 23, 2019
Current: 155Edge
12–18Not supported
79+Supportedsince Jan 15, 2020
Current: 154Firefox
1–148Not supported
149+Supportedsince Mar 24, 2026
Current: 157Safari
1–18.3Not supported
18.4+Supportedsince Mar 31, 2025
Current: 27MobileChrome Android
18–73Not supported
74+Supportedsince Apr 24, 2019
Current: 155Firefox Android
4–148Not supported
149+Supportedsince Mar 24, 2026
Current: 157Safari iOS
1–18.3Not supported
18.4+Supportedsince Mar 31, 2025
Current: 27How to use
Every current browser supports this, but it only became Baseline on Mar 24, 2026. Use it as a progressive enhancement, or keep a fallback if you support older devices.
Example
Full syntax and examples are on MDN: CSPViolationReport.
Feature detection
JS · check before using
if ("ReportingObserver" in globalThis && "ReportingObserver" in ReportingObserver.prototype) {
// ReportingObserver.ReportingObserver is available
}Documentation (MDN)
Specification
Sub-features
Support for each part of the feature (2). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| ReportingObserver.ReportingObserver.options_parameter.types_property.csp-violation | 74 | 79 | 149 | 18.4 | 74 | 149 | 18.4 |
| http.headers.Content-Security-Policy.report-to | 70 | 79 | 149 | 16.4 | 70 | 149 | 16.4 |