Withing Bug 1037335 we implemented most of CSP policy violation events but there are a few dependencies that need to clear before we can ship violation events by default. In particular: * Bug 1418236 * Bug 1418241 * Bug 1418246 * (maybe even others) Currently CSP policy violation events are enabled it Nightly builds (security.csp.enable_violation_events) but obviously it would be great if we can clear those dependencies and ship violation events by default!

Pushed by amarchesini@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/020317ed6cb8 Enable and ship CSP Policy violation events, r=ckerschb

Would be nice to have this in the release-note. Let's mark this bug as relnote-firefox

(In reply to Andrea Marchesini [:baku] from comment #3) > Would be nice to have this in the release-note. Let's mark this bug as > relnote-firefox Andrea, could you provide the release note text and answer the release notes questions to help us understand what this means to the end-user? Thanks Release Note Request (optional, but appreciated) [Why is this notable]: [Affects Firefox for Android]: [Suggested wording]: [Links (documentation, blog post, etc)]:

[Why is this notable]: From the spec: "When one or more of a policy’s directives is violated, a violation report may be generated and sent out to a reporting endpoint associated with the policy." This is important feature for developers. Plus, introducing this feature, Firefox is more compliant with CSP3 spec. [Affects Firefox for Android]: supported [Links (documentation, blog post, etc)]: https://www.w3.org/TR/CSP3/#securitypolicyviolationevent

(In reply to Andrea Marchesini [:baku] from comment #6) > [Why is this notable]: From the spec: "When one or more of a policy’s > directives is violated, a violation report may be generated and sent out to > a reporting endpoint associated with the policy." This is important feature > for developers. Plus, introducing this feature, Firefox is more compliant > with CSP3 spec. > [Affects Firefox for Android]: supported > [Links (documentation, blog post, etc)]: > https://www.w3.org/TR/CSP3/#securitypolicyviolationevent Same question as in https://bugzilla.mozilla.org/show_bug.cgi?id=1470111#c6 :) Thanks!

> Same question as in https://bugzilla.mozilla.org/show_bug.cgi?id=1470111#c6 I guess, same answer :) But this an API! We can add this in the 'new APIs' section.

Removing the relnote request as this will go on the MDN release page.

Updated https://developer.mozilla.org/en-US/docs/Web/API/SecurityPolicyViolationEvent and sub pages. Compat data update: https://github.com/mdn/browser-compat-data/pull/2644 Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/63#APIs