connection-allowlist report, payload and fields

The connection-allowlist report tells you when a page tried to connect to a destination its Connection-Allowlist did not permit.

A connection-allowlist report tells you that a page tried to open a connection to a destination its Connection-Allowlist did not permit. In report-only mode it is the safe way to see what a policy would block before you enforce; under enforcement it is the record of what was blocked.

Experimental, origin trial

This report type comes from the WICG Connection Allowlists proposal, delivered under a Chromium origin trial and available in Chromium-based browsers only. The serialized field names can still change, so treat the payload below as provisional.

When the browser sends it

When a document or worker under a Connection-Allowlist (or Connection-Allowlist-Report-Only) header makes a connection whose destination does not match the allowlist. It covers every connection type the allowlist governs: fetch, WebSocket, WebRTC, navigation, redirects, and subresource loads such as fonts and images.

Payload example

The report arrives in the standard application/reports+json envelope, with the allowlist-specific data in body. The spec does not ship a verbatim sample, so this is illustrative:

{
  "type": "connection-allowlist",
  "age": 12,
  "url": "https://api-next.centralcsp.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "url": "https://api-next.centralcsp.com/",
    "connection": "https://evil.example/collect",
    "allowlist": ["https://*.example.com", "https://cdn.example"],
    "disposition": "enforce"
  }
}

Field reference

Field	Meaning
`url`	The document the report came from (stripped of credentials and fragment).
`connection`	The destination URL that was blocked.
`allowlist`	The URL patterns from the active allowlist.
`disposition`	`enforce` when the connection was blocked, `report` in report-only mode.

How to receive it

Declare an endpoint with a Reporting-Endpoints header, then point the policy at it with the report-to= parameter.

Reporting-Endpoints: connection-endpoint="https://<Endpoint-ID>.report.centralcsp.com"

Connection-Allowlist-Report-Only: (response-origin "https://*.example.com"); report-to=connection-endpoint

What it tells you about security

A connection-allowlist report names a destination your page tried to reach that you never authorized. That is the signal of an exfiltration attempt or a third party reaching somewhere unexpected, the same supply-chain risk script inventory and CSP reporting surface, now at the network-egress layer.

Gotchas

Connection Allowlists is an origin-trial feature, so the report shape is not stable. The serialized field names, and the exact URL stripping applied to url and connection, may differ from the example above and can change as the trial evolves. The spec does not ship a verbatim payload sample, so confirm the fields against a live report from your own traffic before you build parsing around them.

Browser support

Chromium-based browsers only, and only while the origin trial is enabled. Firefox and Safari do not implement it.

Connection-Allowlist