Download the PHP package audunru/reporting-api without Composer

Receive W3C Reporting API and CSP violation reports in Laravel

Browsers send batched reports — CSP violations, deprecations, network errors, crashes, and more — to a configured endpoint. This package registers that endpoint, decodes the payload, and dispatches Laravel events for each report type.

Requirements

• PHP 8.3+
• Laravel 13+

Installation

The service provider is auto-discovered. The package registers a POST /reports route automatically.

Sending reports from a browser

Legacy CSP reports (application/csp-report)

Set the report-uri directive in your Content-Security-Policy header:

With spatie/laravel-csp:

Modern Reporting API (application/reports+json)

Use Reporting-Endpoints and report-to to send batched reports in the modern format:

The modern format supports additional report types beyond CSP violations (deprecations, network errors, crashes, etc.).

With spatie/laravel-csp, add Directive::REPORT_TO in your Policy class:

Also apply the reporting-endpoints middleware (see Middleware) so the Reporting-Endpoints header is sent to browsers alongside the CSP header.

For legacy browser fallback (Firefox and Safari do not support report-to), also set report_uri in config/csp.php. Modern browsers ignore report-uri when report-to is present, so each browser uses the right format automatically:

Getting started

When a report arrives the package dispatches a Laravel event based on the report type. The package ships two ready-made listeners — LogCspViolation and LogReport — that you can register directly in AppServiceProvider::boot():

LogCspViolation logs CSP violations as warning. LogReport logs every other report type as info, with the full raw report in the log context. Neither is registered automatically.

Both log to the stack channel by default. Override protected string $channel to redirect to a different channel:

Filtering noise with shouldExclude()

Browser extensions routinely trigger CSP reports. Override shouldExclude() in a subclass to filter them out:

LogReport supports the same pattern via its Report base type:

Register your subclasses the same way:

Middleware

The package registers a reporting-endpoints middleware alias that adds the Reporting-Endpoints header to responses. Browsers use this header to discover where to POST their reports.

Apply it to specific routes or route groups:

To add it globally to all web routes (Laravel 11+, bootstrap/app.php):

The header value uses the path from your config:

Configuration

Publish the config file to customise the endpoint path and throttle limit:

Reference

Dispatched events

Event interface

All event classes implement audunru\ReportingApi\Contracts\ReportEvent and expose:

Report DTOs

getReport() returns a typed DTO that extends audunru\ReportingApi\DTOs\Report, with properties common to all report types:

Each specific report DTO also has a typed body property whose class matches the report type:

Body classes are plain PHP objects with nullable readonly properties matching the W3C specification for that report type. For example, CspViolationReportBody exposes blockedURL, effectiveDirective, disposition, documentURL, originalPolicy, and so on.