{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/111","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/111/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/111/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/111/events","html_url":"https://github.com/w3c/webappsec-csp/issues/111","id":173435193,"number":111,"title":"Add a flag to strip potentially sensitive data from reports","user":{"login":"ScottHelme","id":5352840,"avatar_url":"https://avatars.githubusercontent.com/u/5352840?v=3","gravatar_id":"","url":"https://api.github.com/users/ScottHelme","html_url":"https://github.com/ScottHelme","followers_url":"https://api.github.com/users/ScottHelme/followers","following_url":"https://api.github.com/users/ScottHelme/following{/other_user}","gists_url":"https://api.github.com/users/ScottHelme/gists{/gist_id}","starred_url":"https://api.github.com/users/ScottHelme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ScottHelme/subscriptions","organizations_url":"https://api.github.com/users/ScottHelme/orgs","repos_url":"https://api.github.com/users/ScottHelme/repos","events_url":"https://api.github.com/users/ScottHelme/events{/privacy}","received_events_url":"https://api.github.com/users/ScottHelme/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/w3c/webappsec-csp/milestones/1","html_url":"https://github.com/w3c/webappsec-csp/milestones/CSP3%20CR","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/milestones/1/labels","id":1980262,"number":1,"title":"CSP3 CR","description":"","creator":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":0,"state":"open","created_at":"2016-09-02T14:24:15Z","updated_at":"2016-09-05T07:23:02Z","due_on":null,"closed_at":null},"comments":24,"created_at":"2016-08-26T11:48:15Z","updated_at":"2016-09-05T07:23:38Z","closed_at":null,"body":"CSP reporting is incredibly useful and provides heaps of valuable data, but it can be difficult for smaller sites to implement. This was my main motivating factor in building https://report-uri.io, a free CSP reporting service. \r\n\r\nIn the course of running this service I've come to terms with lots of odd browser behaviours and created a fairly robust set of filters to eliminate both noise and potentially sensitive information in reports. \r\n\r\n![filters](https://cloud.githubusercontent.com/assets/5352840/18003451/87d5e638-6b85-11e6-8d16-09075423d1a7.png)\r\n\r\nI recently came across an issue where a report was being sent from a page that contained sensitive information in the URL as a query string. As the recipient of the report, report-uri.io had access to this sensitive information. With the above filters the query string is stripped at my edge and never hits storage, nor do I inspect or use the data for any other purposes, but it would be nice if the host had the ability to limit the information sent in the report. As more and more sites use CSP reporting, and CSP reporting as a service increases in popularity, this issue seems like it will only get bigger. \r\n\r\nCould we have some way of limiting the data sent in a report? The first thing that jumps to mind is the ability to strip the fragment and/or query string from locations like the referrer, document-uri and blocked-uri. We could be flexible and even strip the path or provide the option to not send the referrer at all. \r\n\r\nGiven the nature of CSP reporting I don't think we can work on the assumption that reports will be sent to an endpoint under the control of the organisation. "},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/244675690","html_url":"https://github.com/w3c/webappsec-csp/issues/111#issuecomment-244675690","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/111","id":244675690,"user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"created_at":"2016-09-05T07:23:38Z","updated_at":"2016-09-05T07:23:38Z","body":"Ok. I think @estark37 is out of office for a bit; I'll wait for her to chat with @jeisinger about whether they see this as appropriate use of referrer policy. If they're on board, I'll update the CSP spec."}}
{"actor":{"display_login":"mikewest"}}