# Adding support for report-to to ActionDispatch::ContentSecurityPolicy

**URL:** <https://discuss.rubyonrails.org/t/adding-support-for-report-to-to-actiondispatch-contentsecuritypolicy/89787>\
**Category:** rubyonrails-talk\
**Tags:** feature, actiondispatch\
**Created:** [September 11, 2025, 6:25pm UTC](https://discuss.rubyonrails.org/t/adding-support-for-report-to-to-actiondispatch-contentsecuritypolicy/89787 "2025-09-11T18:25:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshuacronemeyer](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/joshuacronemeyer/32/12408_2.png) [@joshuacronemeyer](https://discuss.rubyonrails.org/u/joshuacronemeyer)\
**Post date:** [September 11, 2025, 6:25pm UTC](https://discuss.rubyonrails.org/t/adding-support-for-report-to-to-actiondispatch-contentsecuritypolicy/89787/1 "2025-09-11T18:25:51Z")

</div>

Hi there,

We have to support the newer report-to CSP directive in order to pass our annual security audits without having to do extra administrative work tracking ‘false positives’. We’re doing that now by monkey patching ActionDispatch::ContentSecurityPolicy and adding Reporting-Endpoints headers to all our responses. I noticed back in 2018 [Nu Html Checker (W3C) change report\_uri to report\_to · Issue #33561 · rails/rails · GitHub](https://github.com/rails/rails/issues/33561) we decided not to implement report-to but it looks like most browsers except firefox support this now. Looks like CSP level 3 is still a draft according to this [Web Application Security Working Group Charter](https://www.w3.org/2024/04/wg-webappsec-charter.html)

I’m not sure how the Rails team decides when to adopt, but looks like this one is here to stay since 7 years later from the last time somebody asked about it, it is still a thing, and I don’t think it would be much work. I’d be happy to attempt a PR if there was interest in adding support for this specific directive. Please share your thoughts here.