CSPReportActionBuilder

CSPReportAction exposes CSP content violations according to the CSP reporting spec

Be warned that Firefox and Chrome handle CSP reports very differently, and Firefox omits fields which are in the specification. As such, many fields are optional to ensure browser compatibility.

To use this in a controller, add something like the following:

class CSPReportController @Inject()(cc: ControllerComponents, cspReportAction: CSPReportActionBuilder) extends AbstractController(cc) {

  private val logger = org.slf4j.LoggerFactory.getLogger(getClass)

  private def logReport(report: ScalaCSPReport): Unit = {
    logger.warn(s"violated-directive: ${report.violatedDirective}, blocked = ${report.blockedUri}, policy = ${report.originalPolicy}")
  }

  val report: Action[ScalaCSPReport] = cspReportAction { request =>
    logReport(request.body)
    Ok("{}").as(JSON)
  }
}