---
title: Reporting CSP violations in Laravel 12
url: https://calvin.my/posts/reporting-csp-issues-in-laravel-12
published: 2025-04-17
updated: 2026-09-17
category: Development
tags:
- Laravel
- csp
- Security
summary: The post explains how to collect Content Security Policy violation reports in Laravel 12. It adds a reporting endpoint to the CSP policy, exempts that endpoint from CSRF validation, and routes reports to a controller that logs the request payload or forwards it to external monitoring. It also recommends limiting the endpoint by environment and rate to control noise. Testing involves triggering a policy violation and confirming the report appears in Laravel logs.
---

# Reporting CSP violations in Laravel 12

This article shows the steps to report CSP violations in Laravel 12.

* * *

## The steps

1. Add a report directive to your CSP policy class and specify where you want the errors to be reported.

   ```php
   ->add(Directive::REPORT, '/csp-errors')
   ```

2. Exclude the route from CSRF checking. Otherwise, you might hit 419 errors.

   ```php
   // bootstrap/app.php

       ->withMiddleware(function (Middleware $middleware) {
           $middleware->validateCsrfTokens(except: [
               '/csp-errors',
           ]);
       })
   ```

3. Create a handler for this route, for example, a controller action.

   ```php
   // Controllers/CspError.php

   <?php

   namespace App\Http\Controllers;

   use Illuminate\Http\Request;
   use Illuminate\Support\Facades\Log;

   class CspError extends Controller
   {
       public function __invoke(Request $request)
       {
           $payload = $request->getContent();
           Log::info('CSP Error Reported', [
               'payload' => $payload,
           ]);

           // TODO: Send to 3rd party services

           return response()->json(['status' => 'ok'], 200);
       }
   }
   ```

4. Declare the route.

   ```php
   // routes/web.php

   Route::post('/csp-errors', [\App\Http\Controllers\CspError::class, '__invoke'])
       ->name('csp-errors');
   ```

5. (Optional) Make the route applicable for certain environments only.

6. (Optional) Add a rate limit to the route to prevent the log file from growing due to repetitive errors.

* * *

## Test the implementation

1. Produce a CSP violation and check the Laravel log.

   ```json
   // laravel.log

   {
       "payload": {
           "csp-report": {
               "document-uri": "http://localhost:8000",
               "referrer": "http://localhost:8000",
               "violated-directive": "style-src-elem",
               "effective-directive": "style-src-elem",
               "original-policy": "default-src 'none';connect-src 'self';img-src 'self';font-src fonts.gstatic.com;style-src fonts.googleapis.com 'self';script-src 'self';report-uri /csp-errors",
               "disposition": "enforce",
               "blocked-uri": "inline",
               "line-number": 1,
               "source-file": "http://localhost:8000",
               "status-code": 200,
               "script-sample": ""
           }
       }
   }
   ```