# Connection-Allowlist (/en/docs/web-security/reporting-api/reports/connection-allowlist)



A `connection-allowlist` report tells you that a page tried to open a connection to
a destination its [`Connection-Allowlist`](/en/docs/web-security/policies/connection-allowlist)
did not permit. In report-only mode it is the safe way to see what a policy would
block before you enforce; under enforcement it is the record of what was blocked.

<Callout type="warn" title="Experimental, origin trial">
  This report type comes from the WICG Connection Allowlists proposal, delivered under a Chromium origin trial and available in Chromium-based browsers only. The serialized field names can still change, so treat the payload below as provisional.
</Callout>

## When the browser sends it [#when-the-browser-sends-it]

When a document or worker under a `Connection-Allowlist` (or
`Connection-Allowlist-Report-Only`) header makes a connection whose destination does
not match the allowlist. It covers every connection type the allowlist governs:
fetch, WebSocket, WebRTC, navigation, redirects, and subresource loads such as fonts
and images.

## Payload example [#payload-example]

The report arrives in the standard [`application/reports+json`](/en/docs/web-security/reporting-api/concepts/report-delivery-format)
envelope, with the allowlist-specific data in `body`. The spec does not ship a
verbatim sample, so this is illustrative:

```json
{
  "type": "connection-allowlist",
  "age": 12,
  "url": "https://example.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "url": "https://example.com/",
    "connection": "https://evil.example/collect",
    "allowlist": ["https://*.example.com", "https://cdn.example"],
    "disposition": "enforce"
  }
}
```

## Field reference [#field-reference]

| Field         | Meaning                                                                   |
| ------------- | ------------------------------------------------------------------------- |
| `url`         | The document the report came from (stripped of credentials and fragment). |
| `connection`  | The destination URL that was blocked.                                     |
| `allowlist`   | The URL patterns from the active allowlist.                               |
| `disposition` | `enforce` when the connection was blocked, `report` in report-only mode.  |

## How to receive it [#how-to-receive-it]

Declare an endpoint with a [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
header, then point the policy at it with the `report-to=` parameter.

```http
Reporting-Endpoints: connection-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

```http
Connection-Allowlist-Report-Only: (response-origin "https://*.example.com"); report-to=connection-endpoint
```

## What it tells you about security [#what-it-tells-you-about-security]

A `connection-allowlist` report names a destination your page tried to reach that
you never authorized. That is the signal of an exfiltration attempt or a third party
reaching somewhere unexpected, the same supply-chain risk
[script inventory](/en/docs/platform/features/script-inventory) and CSP reporting
surface, now at the network-egress layer.

## Gotchas [#gotchas]

Connection Allowlists is an origin-trial feature, so the report shape is not stable.
The serialized field names, and the exact URL stripping applied to `url` and
`connection`, may differ from the example above and can change as the trial evolves.
The spec does not ship a verbatim payload sample, so confirm the fields against a
live report from your own traffic before you build parsing around them.

## Browser support [#browser-support]

Chromium-based browsers only, and only while the origin trial is enabled. Firefox and
Safari do not implement it.

## See also [#see-also]

* [Connection-Allowlist header](/en/docs/web-security/policies/connection-allowlist)
* [Connection Allowlists, a network egress sandbox in the browser](/en/blog/connection-allowlists-network-egress)
* [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation)
* [The report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format)

## Sources [#sources]

* [WICG, Connection Allowlists](https://wicg.github.io/connection-allowlists/)
* [Chrome for Developers, Connection Allowlists origin trial](https://developer.chrome.com/blog/connection-allowlists-origin-trial)
* [MDN, Reporting-Endpoints header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints)