{"id":17922,"library":"report-to","title":"Express Report-To Middleware","description":"This package provides Express.js middleware for setting the HTTP `Report-To` response header, crucial for client-side error reporting via browser APIs. Currently at version 1.1.0, it appears to be in a maintenance phase with no major updates since 2021. Its primary function is to configure reporting endpoints for various browser features, such as `Content-Security-Policy` (CSP) violation reports, Network Error Logging (NEL), or Intervention Reports. A key differentiator is its focus solely on configuring the `Report-To` header, rather than implementing the reporting mechanisms themselves. This design choice means it requires integration with other modules (e.g., `network-error-logging` for NEL) to make the reporting functional. The module offers a structured way to define report groups, `max_age`, `include_subdomains`, and multiple prioritized endpoints, adhering to the W3C Reporting API specification.","status":"maintenance","version":"1.1.0","language":"javascript","source_language":"en","source_url":"https://github.com/Cherry/report-to","tags":["javascript","connect","express","middleware","report-to","reportTo","typescript"],"install":[{"cmd":"npm install report-to","lang":"bash","label":"npm"},{"cmd":"yarn add report-to","lang":"bash","label":"yarn"},{"cmd":"pnpm add report-to","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"The primary export is a default function. While the package supports TypeScript, ESM usage should use a default import.","wrong":"import { reportTo } from 'report-to';","symbol":"reportTo","correct":"import reportTo from 'report-to';"},{"note":"CommonJS environments use `require` to import the default function.","wrong":"const { reportTo } = require('report-to');","symbol":"reportTo","correct":"const reportTo = require('report-to');"},{"note":"TypeScript users can import the `ReportToOptions` interface for type-checking the configuration object.","symbol":"ReportToOptions","correct":"import type { ReportToOptions } from 'report-to';"}],"quickstart":{"code":"import express from 'express';\nimport reportTo from 'report-to';\n\nconst app = express();\n\napp.use(reportTo({\n    groups: [\n\t\t{\n\t\t\tgroup: \"endpoint-1\",\n\t\t\tmax_age: 10886400,\n\t\t\tinclude_subdomains: true,\n\t\t\tendpoints: [\n\t\t\t\t{\n\t\t\t\t\turl: \"https://example.com/reports\",\n\t\t\t\t\tpriority: 1\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\turl: \"https://backup.com/reports\",\n\t\t\t\t\tpriority: 2\n\t\t\t\t}\n\t\t\t]\n\t\t}\n\t]\n}));\n\n// Example of also setting NEL header, which uses the 'endpoint-1' group defined above\napp.use((req, res, next) => {\n  res.setHeader('NEL', '{\"report_to\":\"endpoint-1\",\"max_age\":31536000,\"include_subdomains\":true}');\n  next();\n});\n\napp.get('/', (req, res) => {\n  res.send('Hello with Report-To and NEL headers!');\n});\n\nconst PORT = process.env.PORT || 3000;\napp.listen(PORT, () => {\n  console.log(`Server running on port ${PORT}`);\n});","lang":"typescript","description":"This quickstart demonstrates how to integrate `report-to` middleware into an Express application, defining a reporting group. It also includes an example of how a complementary `NEL` header would be set, referencing the defined reporting endpoint, as the `Report-To` header alone does not trigger reports."},"warnings":[{"fix":"Ensure that additional reporting headers (e.g., `Content-Security-Policy` with `report-to`, `NEL`) are also set in your application, referencing the `group` names defined in your `report-to` middleware configuration.","message":"The `Report-To` header configured by this middleware only defines reporting endpoints. For actual client-side error reporting to occur (e.g., CSP violations, Network Error Logging), you must also set other HTTP response headers (like `Content-Security-Policy-Report-Only` or `NEL`) that reference the defined `Report-To` groups.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Set a `max_age` value in your `Report-To` group configuration that is appropriate for your application's reporting needs, typically several days or weeks (e.g., 2592000 for 30 days) to ensure consistent reporting even across multiple user sessions.","message":"The `max_age` property in your `Report-To` configuration should be sufficiently long to allow browsers to cache the reporting endpoint configuration. Short `max_age` values can lead to unreliable reporting, as browsers might drop the configuration too quickly.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"search_vec":"'1.1.0':33 '2021':47 'adher':137 'age':130 'api':29,142 'appear':35 'browser':28,58 'choic':99 'client':23 'client-sid':22 'configur':53,84 'connect':145 'content':63 'content-security-polici':62 'crucial':20 'csp':66 'current':30 'defin':126 'design':98 'differenti':78 'e.g':107 'endpoint':55,136 'error':25,70,110 'express':1,146 'express.js':9 'featur':59 'focus':81 'function':50,118 'group':128 'header':19,89 'http':14 'implement':92 'includ':131 'integr':103 'intervent':74 'javascript':144 'key':77 'log':71,111 'mainten':40 'major':44 'make':115 'max':129 'mean':100 'mechan':95 'middlewar':5,10,147 'modul':106,120 'multipl':134 'nel':72,113 'network':69,109 'network-error-log':108 'offer':121 'packag':7 'phase':41 'polici':65 'primari':49 'priorit':135 'provid':8 'rather':90 'report':3,16,26,54,68,75,87,94,117,127,141,149 'report-to':2,15,86,148 'reportto':151 'requir':102 'respons':18 'secur':64 'set':12 'side':24 'sinc':46 'sole':82 'specif':143 'structur':123 'subdomain':132 'typescript':152 'updat':45 'various':57 'version':32 'via':27 'violat':67 'w3c':140 'way':124","created_at":"2026-04-23T17:48:49.245570+00:00","updated_at":"2026-04-23T17:48:49.245570+00:00","problems":[{"fix":"For ESM: `import reportTo from 'report-to';`. For CommonJS: `const reportTo = require('report-to');`.","cause":"Attempting to use `reportTo` as a named import or without invoking it as a function when requiring it in CommonJS.","error":"TypeError: reportTo is not a function"},{"fix":"Ensure `app.use(reportTo({...}));` is called before sending responses, and verify that the `groups` array in the configuration is correctly structured with `group`, `max_age`, and `endpoints` properties.","cause":"The `report-to` middleware was not applied to the Express app, or the configuration object passed to it was invalid or missing the `groups` array.","error":"HTTP Header 'Report-To' is missing or invalid in browser developer tools"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/Cherry/report-to","docs":null,"changelog":null,"pypi":null,"npm":"https://www.npmjs.com/package/report-to","openapi_spec":null,"status_page":null,"smithery":null,"categories":["http-networking","web-framework","observability","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-17","next_check":"2026-07-22","install_tag":null}}