The default reporting endpoint
The default endpoint in Reporting-Endpoints catches report types with no explicit target, including deprecation, intervention, and crash reports.
Last update:
default is the special endpoint name in the
Reporting-Endpoints header that
catches report types the browser has nowhere else to send. Several report types are not
tied to a per-policy directive, so they have no named endpoint to reference. The browser
routes those to the endpoint you call default, and to nothing if you have not declared
one.
What goes to the default endpoint
Some reports come from a policy that names its own endpoint (for example CSP names one
with its report-to directive). Others are emitted by the browser itself, with no
directive to point them anywhere. Those fall back to default:
deprecationreports, emitted when the page uses a web feature scheduled for removal.interventionreports, emitted when the browser refuses or alters something the page asked for.crashreports, emitted when the document crashes.
Any report whose type has no matching named endpoint is delivered to default as
well. If default is not declared, those reports are dropped. See the full list on the
reports page.
Named endpoints do not catch these
This is the part that trips people up. A named endpoint such as csp-endpoint only
receives reports from a policy that explicitly references it. It does not act as a
catch-all. If you declare only a named endpoint and no default, your deprecation,
intervention, and crash reports have nowhere to go and never arrive, with no error
anywhere.
If your deprecation, intervention, or crash reports never show up, the usual cause is a
missing default endpoint. Named endpoints only catch what a policy points at them.
A minimal example
Declare both a named endpoint for your policy and a default for everything else. Each
maps a name to an HTTPS URL.
Reporting-Endpoints: csp-endpoint="https://<Endpoint-ID>.report.centralcsp.com",
default="https://<Endpoint-ID>.report.centralcsp.com"The two URLs can be the same or different. Point default at a separate URL if you want
to keep browser-emitted reports out of your CSP stream, or reuse one URL to collect
everything together. To confirm a live site routes both correctly without building a
receiver, use the
Reporting API configuration checker, and to collect and
aggregate every report type without standing up a backend, point the endpoints at
CentralCSP reporting. The end-to-end setup is in
how to set up the Reporting API.