I'm using the following PHP script to test CSP policy,
<?php
header("Content-Security-Policy: default-src https:; report-uri /report.php");
header("Content-Security-Policy: default-src 'self'");
?>
<html>
<body>
<script src="http://google/abc.js"></script>
</body>
</html>
The CSP policy works,
But the report-uri
part didn't. The reporting request was never sent and no relevant entry in nginx access logs
Any ideas?