Christoph Kerschbaumer [:ckerschb] Reporter
	Description • 6 years ago

Withing Bug 1037335 we implemented most of CSP policy violation events but there are a few dependencies that need to clear before we can ship violation events by default. In particular:
* Bug 1418236
* Bug 1418241
* Bug 1418246
* (maybe even others)

Currently CSP policy violation events are enabled it Nightly builds (security.csp.enable_violation_events) but obviously it would be great if we can clear those dependencies and ship violation events by default!

	Pulsebot
	Comment 2 • 6 years ago

Pushed by amarchesini@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/020317ed6cb8
Enable and ship CSP Policy violation events, r=ckerschb

	Andrea Marchesini [:baku] Assignee
	Comment 3 • 6 years ago

Would be nice to have this in the release-note. Let's mark this bug as relnote-firefox

	Cosmin Sabou [:CosminS]
	Comment 4 • 6 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/020317ed6cb8

	Pascal Chevrel:pascalc (PTO until April 26)
	Comment 5 • 6 years ago

(In reply to Andrea Marchesini [:baku] from comment #3)
> Would be nice to have this in the release-note. Let's mark this bug as
> relnote-firefox

Andrea, could you provide the release note text and answer the release notes questions to help us understand what this means to the end-user? 
Thanks

Release Note Request (optional, but appreciated)
[Why is this notable]:
[Affects Firefox for Android]:
[Suggested wording]:
[Links (documentation, blog post, etc)]:

	Andrea Marchesini [:baku] Assignee
	Comment 6 • 6 years ago

[Why is this notable]: From the spec: "When one or more of a policy’s directives is violated, a violation report may be generated and sent out to a reporting endpoint associated with the policy." This is important feature for developers. Plus, introducing this feature, Firefox is more compliant with CSP3 spec.
[Affects Firefox for Android]: supported
[Links (documentation, blog post, etc)]: https://www.w3.org/TR/CSP3/#securitypolicyviolationevent

	Pascal Chevrel:pascalc (PTO until April 26)
	Comment 7 • 6 years ago

(In reply to Andrea Marchesini [:baku] from comment #6)
> [Why is this notable]: From the spec: "When one or more of a policy’s
> directives is violated, a violation report may be generated and sent out to
> a reporting endpoint associated with the policy." This is important feature
> for developers. Plus, introducing this feature, Firefox is more compliant
> with CSP3 spec.
> [Affects Firefox for Android]: supported
> [Links (documentation, blog post, etc)]:
> https://www.w3.org/TR/CSP3/#securitypolicyviolationevent

Same question as in  https://bugzilla.mozilla.org/show_bug.cgi?id=1470111#c6 :)

Thanks!

	Andrea Marchesini [:baku] Assignee
	Comment 8 • 6 years ago

> Same question as in  https://bugzilla.mozilla.org/show_bug.cgi?id=1470111#c6

I guess, same answer :) But this an API! We can add this in the 'new APIs' section.

	Pascal Chevrel:pascalc (PTO until April 26)
	Comment 9 • 6 years ago

Removing the relnote request as this will go on the MDN release page.

	Florian Scholz (Open Web Docs)
	Comment 10 • 6 years ago

Updated https://developer.mozilla.org/en-US/docs/Web/API/SecurityPolicyViolationEvent and sub pages.
Compat data update: https://github.com/mdn/browser-compat-data/pull/2644
Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/63#APIs