Browser security policies and how each one reports
How each configurable browser policy works, what it protects against, and how it reports through the Reporting API.
Last update:
A policy is a set of rules the browser enforces, configured through a response header. Each policy can point its reports at an endpoint, so you see what it would block before you enforce it. These pages explain what each policy protects against, how to configure it, and how to wire its reporting. Content Security Policy is the deepest sub-tree.
Policies in this section
Content Security Policy (CSP)
Control what a page may load and run. The flagship.
Cross-Origin-Opener-Policy (COOP)
Isolate your window from cross-origin openers.
Cross-Origin-Embedder-Policy (COEP)
Require cross-origin resources to opt in.
Permissions-Policy
Allow or deny browser features per context.
Document-Policy
Constrain per-document behavior.
Integrity-Policy
Require Subresource Integrity on loaded resources.
Network Error Logging (NEL)
Report network-level request failures.
Connection-Allowlist
Declare the destinations a page may connect to, deny by default.
Legacy security headers
Older headers and their modern replacements.
How a policy reports
Every policy points at an endpoint declared in a header, but each names it a little differently:
- CSP uses the
report-todirective (and the deprecatedreport-uri). - COOP, COEP, Permissions-Policy, and Connection-Allowlist use a
report-to=parameter on the header. - Integrity-Policy uses the
endpoints=()directive. - NEL is the exception: it names a group in the legacy
Report-Toheader, notReporting-Endpoints.
Whichever a policy uses, the name has to match one declared on the same response, and the browser then emits the matching report type.
See also
- Headers
- Report types
- Security headers, the headers that do not emit reports: HSTS, cookie attributes, nosniff, Referrer-Policy
- Monitor every policy in one place with CentralCSP.