title: How to add Report-To Content-Security-Policy directly in web.config
body: <p>I'm trying to implement <code>report-uri</code> and <code>report-to</code> in front-end app. </p>
  
  <p><strong>report-uri</strong>:</p>
  
  <p>I accomplished the goal expanding current <code>Content-Security-Policy</code> header value with <code>report-uri</code> and this is working: </p>
  
  <p><code>&lt;add name="Content-Security-Policy" value="default-src 'self' 'unsafe-inline' data: google.com; report-uri http://localhost:51260/api/csp/report;"/&gt;</code></p>
  
  <p><strong>report-to</strong>:</p>
  
  <p>Following the instructions I undertstood that I need to add two things: new <code>Report-To</code> header and new instruction in <code>Content-Security-Policy</code> so I've escaped the stringified json for report-to and added them web.config:</p>
  
  <pre><code>&lt;add name="Report-to" value="{&amp;quot;endpoints&amp;quot;:[{&amp;quot;url&amp;quot;:&amp;quot;https://localhost:51260/api/csp/report-to&amp;quot;}],&amp;quot;include_subdomains&amp;quot;:true,&amp;quot;group&amp;quot;:&amp;quot;csp-endpoint&amp;quot;,&amp;quot;max_age&amp;quot;:31536000}" /&gt;          
  &lt;add name="Content-Security-Policy" value="default-src 'self' 'unsafe-inline' data: google.com; report-uri http://localhost:51260/api/csp/report; report-to csp-endpoint;"/&gt;
  </code></pre>
  
  <p>but it does not work.</p>
  
  <p>Unescaped value:</p>
  
  <p><code>{"endpoints":[{"url":"https://localhost:51260/api/csp/report-to"}],"include_subdomains":true,"group":"csp-endpoint","max_age":31536000}</code></p>
  
  <p>For reference:</p>
  
  <ol>
  <li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri" rel="noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri</a></li>
  <li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to" rel="noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to</a></li>
  </ol>