[GH-ISSUE #21830] feat: Extend #4925 Security response headers to include Reporting-Endpoints header to aid in CSP debugging #35116

New Issue

GiteaMirror · 2026-04-25T09:19:27-05:00

GiteaMirror commented

2026-04-25 09:19:27 -05:00

Originally created by @mgetzflex on GitHub (Feb 24, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/21830

Check Existing Issues

I have searched for all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Verify Feature Scope

I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.

Problem Description

As a SecDevOps engineer looking to harden my instance of Open-WebUi I need the ability to set the Reporting-Endpoints header such that I can receive the CSP violation reports directly rather than having to wait on users to report them

Desired Solution you'd like

Extend #4925 by adding a new handler for REPORTING_ENDPOINTS environment variable. That then sets the Reporting-Endpoints header if set.

Alternatives Considered

None.

Additional Context

This is a nice to have, but not critical. It would help get CSPs locked down. It should be quick to implement as it can be completely contained within backend/open_webui/utils/security_headers.py

# Set Reporting-Endpoints response header
def set_reporting_endpoints(value: str):
    return {"Reporting-Endpoints": value}

Originally created by @mgetzflex on GitHub (Feb 24, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/21830 ### Check Existing Issues - [x] I have searched for all existing **open AND closed** issues and discussions for similar requests. I have found none that is comparable to my request. ### Verify Feature Scope - [x] I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions. ### Problem Description As a SecDevOps engineer looking to harden my instance of Open-WebUi I need the ability to set the [`Reporting-Endpoints`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints) header such that I can receive the CSP violation reports directly rather than having to wait on users to report them ### Desired Solution you'd like Extend #4925 by adding a new handler for `REPORTING_ENDPOINTS` environment variable. That then sets the `Reporting-Endpoints` header if set. ### Alternatives Considered None. ### Additional Context This is a nice to have, but not critical. It would help get CSPs locked down. It should be quick to implement as it can be completely contained within `backend/open_webui/utils/security_headers.py` ```python # Set Reporting-Endpoints response header def set_reporting_endpoints(value: str): return {"Reporting-Endpoints": value} ```

GiteaMirror closed this issue

2026-04-25 09:19:28 -05:00

GiteaMirror commented

2026-04-25 09:19:29 -05:00

@tjbck commented on GitHub (Feb 24, 2026):

Addressed in dev.

@tjbck commented on GitHub (Feb 24, 2026): Addressed in dev.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#35116