Call me cynical, but I believe reporting causes more harm than good, by exposing new attack surface.
Why not just deploy a crawler that detects CSP errors and reports them in a static report for the site owner?
Call me cynical, but I believe reporting causes more harm than good, by exposing new attack surface.
Why not just deploy a crawler that detects CSP errors and reports them in a static report for the site owner?
In addition, the Web Reporting API covers more than just CSP. It can also report various types of certificate errors, such as those triggered by violations of the Expect-CT and Expect-Staple headers (such violations might occur if your users are under attack by a MITM).
On the other hand, you are right that the crawler wouldn't catch everything.
That said, it's true that the biggest practical use people get out of report-uri is to test the roll-out of these headers and to detect issues they might cause.
I believe the benefit of having users' browsers report this over a crawler is for scenarios where pages attempt to display your content from another site (e.g. in an iframe behind an overlay for a click-jacking attack). You'd never know to monitor that URL / wouldn't know that the site was hosting your content from any of your metrics; but the users browsers would report it.
In terms of "why report it if they know to block it anyway", I believe the idea is to improve security for others; i.e. we're no longer relying on users having the latest browser to be protected; so long as one user had a browser good enough to spot the issue, we can be made aware that there's a risk out there.