Adds reporting API and other reports #10925

rachelandrew · 2021-06-10T09:39:16Z

Making a PR I need to get some feedback on this.

The Reporting API is one of the things we're documenting over at Google and it was missing BCD.

This includes the Reporting API interfaces themselves, but also some reports which are now in separate specs (those Interfaces that are documented on MDN already refer to the old Reporting API spec which included them).

So this includes:

Report
ReportBody

Which are part of the Reporting API: https://w3c.github.io/reporting/#interface-reporting-observer
Chrome Status for the Reporting API: https://www.chromestatus.com/feature/4672626140119040

I believe that the original reports that were part of the Reporting API:

CrashReportBody
DeprecationReportBody
InterventionReportBody

were shipped at the same time, but I'm having trouble confirming.

I also have PermissionsPolicyViolationReportBody from the Permissions Policy Spec: https://w3c.github.io/webappsec-permissions-policy/#permissionspolicyviolationreportbody

Chrome Status for the header/that spec although I know this has all recently changed from Feature Policy https://www.chromestatus.com/feature/5745992911552512

CSPViolationReportBody from the Content Security Policy spec: https://www.w3.org/TR/CSP3/#cspviolationreportbody

Then there are two interfaces which seem to exist in Chrome IDLs but I can't find a spec for, so I haven't included them in this PR so far.

CoopViolationReportBody which I only find mentioned in an explainer though it appears to have shipped in Chrome: https://www.chromestatus.com/feature/5755687994916864
DocumentPolicyViolationReportBody which I can't find anywhere.

I did however find this issue: w3c/reporting#216

So that's where I got to, and I figured it might be easier to open this then ping relevant people to help me fill in the blanks.

jpmedley · 2021-06-14T13:42:30Z

@foolip Would you mind reviewing this instead? I think you're more tuned into BCD issues these days than I am.

api/ReportBody.json

foolip · 2021-06-14T14:31:13Z

api/CSPViolationReportBody.json

+        "spec_url": "https://www.w3.org/TR/CSP3/#cspviolationreportbody",
+        "support": {
+          "chrome": {
+            "version_added": "69"


Testing in https://mdn-bcd-collector.appspot.com/tests/api/CSPViolationReportBody suggests this isn't shipped yet.

But that's because none of these interface objects are exposed. Without them, one would have to dig through Chromium source to figure out when each one shipped.

It appears that this API had actually landed in Chrome 74 as per https://storage.googleapis.com/chromium-find-releases-static/88d.html#88dcf893609cf4916ee33aef1f7658f18f13f760. @rachelandrew, do you mind updating this?

foolip · 2021-06-14T15:20:55Z

@clelland this is a PR to add data for Report and *ReportBody APIs to BCD, for MDN compat tables. Due to https://crbug.com/1201273 it's hard to figure out when each part was shipped. Perhaps you know which runtime flags were involved here and when they were flipped?

maudnals · 2021-06-17T11:01:50Z

Hi, I'm a web devRel and have been working on this API.

@clelland has details on this, but some info below that may help see the report structure:

Demo

We've built recently this demo endpoint where reports of various types are sent and their structure can be visualized. This demo endpoint provides instructions on how to generate the reports.
Run it with Chrome Canary and use the CLI flag --short-reporting-delay to get reports immediately.
Attached below is a screenshot of a few reports.

Supported reports

Reports that I've seen (empirically) generated and properly sent in Chrome 92 in this demo are:

CSP Level 3 violation
Deprecation
COOP violation
COEP violation
Document-policy violation reports
Crash reports
Intervention reports

Permissions policy violation reports were generated too but AFAIK these are only experimental (source: @clelland).

maudnals · 2021-10-06T15:59:11Z

@rachelandrew Hi Rachel, does the demo help answer the initial question? If not, what would help unblock this?
Additional info: Safari now supports Reporting API (via report-to) for COOP (bug).

rachelandrew · 2021-10-08T11:05:24Z

@maudnals it would be great to get this over the line, it's still not clear to me when each part of this was shipped. If I can get that info I can update the PR.

maudnals · 2021-10-08T12:15:31Z

Noted!

@clelland, would you please help clarify when each part of this has shipped, so that this can be documented on MDN?

@rachelandrew,

[EDIT] Question: IIUC this means that:

COOP Violation Reports
COEP Violation Reports
Document-Policy violation reports

Won't be documented on MDN for now, since they don't have a spec. Is this correct?

One more question (this may not be in scope for this PR, so let me know if there's a better place to discuss this!):
Chrome 96 will ship the Reporting API v1; it's configured via the Reporting-Endpoints header as opposed to the legacy Report-To header. The Reporting API v1 sends exactly the same report format and content type as v0.
Will it be possible to document v1 on MDN? Should this live on the Reporting API page?

clelland · 2021-10-08T15:09:19Z

I dug into bugs, source control and config history for these, and I think I've teased out all of the relevant dates:

The V0 reporting API shipped in Chrome 69, and at launch included:

Report-To header
ReportingObserver JS API (in documents)
Deprecation Reports
Network Error Logging

Intervention reports shipped in Chrome 70
Crash reports shipped in Chrome 72

ReportingObserver shipped in workers in Chrome 84

Document Policy shipped in Chrome 86 (The document-policy-violation report type is technically defined here -- that one is defined without an interface, which was an approach that was discussed in w3c/reporting#216)

COOP Reporting shipped in Chrome 89

Permissions Policy reporting has never actually shipped; it was an experiment (as Feature Policy reporting) in Chrome for a while, but was disabled after that.

rachelandrew · 2021-10-12T12:24:25Z

ReportingObserver looks correct in BCD.
I think generally this PR represents reality.
the document-policy and other headers will need documenting here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
Chrome has DocumentPolicyViolationReportBody but I don't understand from the above how that should be documented. Looking at the discussion should it be the same as https://w3c.github.io/webappsec-permissions-policy/#permissionspolicyviolationreportbody ?

As far as the differences between v0 and v1, then yes that's something that could go onto MDN. It should also be represented in BCD, probably by including the availability of the Reporting-Endpoints header. Given that v0 is not going to be supported cross-browser, perhaps the thing to do is to essentially make v1 the primary version and v0 as an earlier version. Though I'd need to get some advice from the MDN folks.

I think probably the best thing to do right now is to make sure this PR, which represents things that are in specs is accurate and see if we can get it merged, then look at dealing with the other bits in separate PRs.

Also, just a note that I'm happy to help get this over the line but it was part of work I was doing as a contractor, and I'm now a FT Googler so apologies for slowness of responses as I'm not spending 20 hours a week putting things on MDN right now. :)

queengooborg

Thank you, this is LGTM!

This PR updates and corrects version values for Chromium (Chrome, Opera, Samsung Internet, WebView Android) for the `CSPViolationReportBody` API, based upon results from the [mdn-bcd-collector](https://mdn-bcd-collector.gooborg.com) project (v7.1.2). Tests Used: https://mdn-bcd-collector.gooborg.com/tests/api/CSPViolationReportBody _Check out the [collector's guide on how to review this PR](https://github.com/GooborgStudios/mdn-bcd-collector#reviewing-bcd-changes)._ Note: this was originally set to "74" in mdn#10925 based upon commit history. However, while Chrome seems to have IDL for this feature, it's not exposed.

Adds reporting API and other reports

54aea89

rachelandrew marked this pull request as draft June 10, 2021 09:39

github-actions bot added the data:api Compat data for Web APIs. https://developer.mozilla.org/docs/Web/API label Jun 10, 2021

rachelandrew requested a review from jpmedley June 10, 2021 09:39

teoli2003 mentioned this pull request Jun 13, 2021

Replace spec table with {{specifications}} for api/[ij]* mdn/content#5952

Merged

foolip reviewed Jun 14, 2021

View reviewed changes

api/ReportBody.json Outdated Show resolved Hide resolved

api/ReportBody.json Outdated Show resolved Hide resolved

Update api/ReportBody.json

9a86ede

foolip reviewed Jun 14, 2021

View reviewed changes

teoli2003 mentioned this pull request Jun 15, 2021

Replace spec table with {{specifications}} for api/r[a-s]* mdn/content#6018

Merged

rachelandrew mentioned this pull request Jun 29, 2021

Adds missing InterventionReportBody property pages mdn/content#6452

Merged

rachelandrew marked this pull request as ready for review October 12, 2021 12:24

updates to reports

b0b602b

GPHemsley mentioned this pull request Jan 17, 2022

Can I use Reporting API Fyrd/caniuse#2375

Open

queengooborg self-requested a review May 3, 2022 12:10

queengooborg removed their request for review May 13, 2022 06:55

update CSPViolationReportBody

c6e5e55

rachelandrew requested a review from queengooborg May 13, 2022 14:25

queengooborg approved these changes May 13, 2022

View reviewed changes

queengooborg merged commit 75d1a90 into mdn:main May 13, 2022

queengooborg mentioned this pull request May 16, 2022

Replace non-existent {{compat}} with standard text mdn/content#16066

Merged

teoli2003 mentioned this pull request May 16, 2022

Update Compat section as the Reporting API is now in bcd mdn/content#16093

Merged

queengooborg mentioned this pull request Jan 5, 2023

Update Chromium versions for CSPViolationReportBody API #18540

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds reporting API and other reports #10925

Adds reporting API and other reports #10925

rachelandrew commented Jun 10, 2021

jpmedley commented Jun 14, 2021

foolip Jun 14, 2021

queengooborg May 6, 2022

rachelandrew May 13, 2022

foolip commented Jun 14, 2021

maudnals commented Jun 17, 2021 •

edited

Loading

maudnals commented Oct 6, 2021 •

edited

Loading

rachelandrew commented Oct 8, 2021

maudnals commented Oct 8, 2021 •

edited

Loading

clelland commented Oct 8, 2021

rachelandrew commented Oct 12, 2021

queengooborg left a comment

Adds reporting API and other reports #10925

Adds reporting API and other reports #10925

Conversation

rachelandrew commented Jun 10, 2021

jpmedley commented Jun 14, 2021

foolip Jun 14, 2021

Choose a reason for hiding this comment

queengooborg May 6, 2022

Choose a reason for hiding this comment

rachelandrew May 13, 2022

Choose a reason for hiding this comment

foolip commented Jun 14, 2021

maudnals commented Jun 17, 2021 • edited Loading

Demo

Supported reports

maudnals commented Oct 6, 2021 • edited Loading

rachelandrew commented Oct 8, 2021

maudnals commented Oct 8, 2021 • edited Loading

clelland commented Oct 8, 2021

rachelandrew commented Oct 12, 2021

queengooborg left a comment

Choose a reason for hiding this comment

maudnals commented Jun 17, 2021 •

edited

Loading

maudnals commented Oct 6, 2021 •

edited

Loading

maudnals commented Oct 8, 2021 •

edited

Loading