User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0 Build ID: 20151210084639 Steps to reproduce: Take any page on a web-site with Content Security Policy set and add any img tag referring an image file outside permitted sources in Content Security Policy, so the browser ought to report the violation making post request to the URI specified in report-uri directive. Actual results: Firefox version 43 on Ubuntu 15.10 make the POST request to the URI as specified, however it doesn't send any HTTP cookie stored for the site it is trying to access. It does send such cookies for any other request to the same web site. Expected results: The browser must provide HTTP cookies with any request sent to a web-site, include the request made according to report-uri directive in Content Security Policy.

steve can you help me figure out if this request is supposed to be anonymous? (and if so, close as invalid)

Thanks Pat - this sounds like expected behavior to me, i.e. avoiding leaking user cookies to a reporting system. Chris, can you confirm this and mark the bug per Pat's request?

(In reply to Steve Workman [:sworkman] (please use needinfo) from comment #2) > Thanks Pat - this sounds like expected behavior to me, i.e. avoiding leaking > user cookies to a reporting system. Chris, can you confirm this and mark the > bug per Pat's request? You are absolutely right steve, we do not want to send cookies in case the report-uri was injected. See code and comment here: https://hg.mozilla.org/integration/mozilla-inbound/rev/fb00a01bf9f3#l1.444

Content Security Policy Level 2 recommendation requires blocking cookies only when reporting uri is not of the same origin, see https://www.w3.org/TR/CSP2/#send-violation-reports With dropping cookies unconditionally you just make violation reporting for protected sites either unavailable (as the sever will not be able distinguish logged in session stored in a cookie) either becomes prone to flooding attacks on reporting uri if they decide to accept reports from any client.

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258