I was implementing a CSP policy and set up the reporting endpoint as another domain, a completely separate origin. Everything seemed to work fine, but talking to a few friends they seemed surprised that it worked as they thought that CSP reports could only go to the same domain or a subdomain. I looked around online and read through the spec but didn't find anything that substantiated their theory that it used to be that way.
I'm cautious going forward because I'd rather set up a reporting endpoint that I could get consistently rather than one that might fail on older browsers. Is there any truth to their suspicions that cross-origin reporting used to not be supported?
Thanks in advance :)