Description

The Content Security Policy reports trigger rule Request content type is not allowed by policy (920420)

Content-Type: application/reports+json

Can this content-type be allowed, or a default exclusion for the reporting URL made?

Happy to do the work and provide this with your guidance.

How to reproduce the misbehavior (-> curl call)

curl -H 'Content-Type: application/reports+json' localhost/csp-reports

Your Environment

• CRS version (e.g., v3.3.4): latest
• Paranoia level setting (e.g. PL1) : PL2
• ModSecurity version (e.g., 2.9.6): -
• Web Server and version or cloud provider / CDN (e.g., Apache httpd 2.4.54): local installation
• Operating System and version: Ubuntu

Confirmation

[x] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.