Change #1277205 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/core@master] Add Reporting-Endpoints header support and fix report-to directive functionality

https://gerrit.wikimedia.org/r/1277205

Test wiki created on Patch demo by SBassett (WMF) using patch(es) linked to this task:
https://173e7e3460.catalyst.wmcloud.org/w/

Change #1277205 merged by jenkins-bot:

[mediawiki/core@master] Add Reporting-Endpoints header support and fix report-to directive

https://gerrit.wikimedia.org/r/1277205

Change #1284001 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/core@master] Remove erroneous @var type statements

https://gerrit.wikimedia.org/r/1284001

Change #1284008 had a related patch set uploaded (by SBassett; author: SBassett):

[operations/mediawiki-config@master] Enable CSPUseReportURIDirective in Wikimedia production

https://gerrit.wikimedia.org/r/1284008

Change #1284001 merged by jenkins-bot:

[mediawiki/core@master] Remove erroneous @var type statements

https://gerrit.wikimedia.org/r/1284001

Change #1284008 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable CSPUseReportURIDirective in Wikimedia production

https://gerrit.wikimedia.org/r/1284008

Mentioned in SAL (#wikimedia-operations) [2026-05-11T21:09:07Z] <mstyles@deploy1003> Started scap sync-world: Backport for [[gerrit:1284008|Enable CSPUseReportURIDirective in Wikimedia production (T424058)]]

Mentioned in SAL (#wikimedia-operations) [2026-05-11T21:10:50Z] <mstyles@deploy1003> sbassett, mstyles: Backport for [[gerrit:1284008|Enable CSPUseReportURIDirective in Wikimedia production (T424058)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-05-11T21:15:43Z] <mstyles@deploy1003> Finished scap sync-world: Backport for [[gerrit:1284008|Enable CSPUseReportURIDirective in Wikimedia production (T424058)]] (duration: 06m 36s)

This works fine for me testing locally with MediaWiki master and MediaWiki-docker:

content-security-policy: script-src 'unsafe-eval' blob: 'self' localhost localhost:* 127.0.0.1 127.0.0.1: 'unsafe-inline'; default-src 'self' data: blob: localhost localhost:* 127.0.0.1 127.0.0.1:; style-src 'self' data: blob: localhost localhost:* 127.0.0.1 127.0.0.1: 'unsafe-inline'; object-src 'none'; report-uri /w/api.php?action=cspreport&format=json; report-to csp-report-to-endpoint
...
reporting-endpoints: csp-report-to-endpoint='/w/api.php?action=cspreport&format=json';

And the extensive unit tests that account for multiple config scenarios still appear to be correct and passing.

So looking at mediawiki.org - when logged out, I get the old report-uri directive and no reporting-endpoints header. When logged in, I only get the report-to directive and the correct reporting-endpoints header. I understood that the current config should be setting both directives in both situations. @ssingh, @Bawolff - any thoughts on what might be happening here? I find the behavior confusing, since we should no longer be setting CSP via any session-related flags/values or $wgExtensionFunctions.

Well, this has had an impact on CSP reports:

@sbassett: I am having a bit of trouble parsing what exactly is failing, but if it is just the report-to header, note that we set that in Varnish (VCL) for Network Error Logging. That looks like, for example,

report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }

Which means that it doesn't matter what you set at MW -- the Varnish one will override that. Is that what is happening here? Note we only set report-to and not reporting-endpoints.

So yeah, if we want to update report-to, we will need to do that in VCL.

@ssingh - It's that, with current MW config, we should be seeing both the report-to directive in the CSP policy (and corresponding report endpoint) and the report-uri directive. We are currently seeing the correct report-to directive (and corresponding report endpoint) everywhere now (not as I had previously reported). This shouldn't really have anything to do with the report-to header.

For example, just going to enwiki logged-in or logged-out right now, I see:

content-security-policy: script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org mediawiki.org wikimedia.org *.wmflabs.org *.wmcloud.org *.toolforge.org wss://*.toolforge.org *.jsdelivr.net unpkg.com cdnjs.cloudflare.com ...{a big list of more domains}... db.onlinewebfonts.com fontlibrary.org 'unsafe-inline'; object-src 'none'; report-to csp-report-to-endpoint
...
reporting-endpoints: csp-report-to-endpoint='/w/api.php?action=cspreport&format=json';

This is correct, but there should also be a redundant report-uri directive as well. This was set via https://gerrit.wikimedia.org/r/1284008 for both Wikimedia production and beta. And the config variable is set to true when I check it via shell.php on deployment:

> print_r( $wmgCSPUseReportURIDirective );
= true

> print_r( $wgCSPUseReportURIDirective );

= true

This also works as expected testing in MediaWiki-Docker and in the WM core CSP unit tests. So I'm just trying to debug why the redundant report-uri directive is not showing up in Wikimedia production as is expected. I'm running out of ideas and wanted to double-check that there was no conflicting VCL or other config interfering here.

Change #1288999 had a related patch set uploaded (by SBassett; author: SBassett):

[operations/mediawiki-config@master] Explicitly set wgCSPUseReportURIDirective and not wmgCSPUseReportURIDirective to true

https://gerrit.wikimedia.org/r/1288999

Change #1288999 merged by jenkins-bot:

[operations/mediawiki-config@master] Explicitly set wgCSPUseReportURIDirective and not wmgCSPUseReportURIDirective to true

https://gerrit.wikimedia.org/r/1288999

Mentioned in SAL (#wikimedia-operations) [2026-05-19T20:49:09Z] <sbassett@deploy1003> Started scap sync-world: Backport for [[gerrit:1288999|Explicitly set wgCSPUseReportURIDirective and not wmgCSPUseReportURIDirective to true (T424058)]]

Mentioned in SAL (#wikimedia-operations) [2026-05-19T20:51:02Z] <sbassett@deploy1003> sbassett: Backport for [[gerrit:1288999|Explicitly set wgCSPUseReportURIDirective and not wmgCSPUseReportURIDirective to true (T424058)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-05-19T20:55:49Z] <sbassett@deploy1003> Finished scap sync-world: Backport for [[gerrit:1288999|Explicitly set wgCSPUseReportURIDirective and not wmgCSPUseReportURIDirective to true (T424058)]] (duration: 06m 40s)

Test wiki on Patch demo by SBassett (WMF) using patch(es) linked to this task was deleted:

https://173e7e3460.catalyst.wmcloud.org/w/