NEL & Reporting API Auditor

Audit a public URL's Network Error Logging (NEL) and Reporting API configuration in one API call. Deep-parses the NEL, Report-To, and Reporting-Endpoints response headers, validates endpoint-group wiring against the W3C NEL and Reporting API specs, detects dangling report_to references and report loops, and returns a readiness score, letter grade, and recommendations. Built for web platform engineers, reliability/observability teams, and security/QA consultants.

Use cases

• Web platform engineers - verify NEL and Report-To wiring before enabling client-side network error telemetry in production
• Reliability / observability (SRE) teams - confirm report collectors (report-uri.com, self-hosted collectors) are actually referenced by well-formed headers from an external vantage point
• CDN users - detect Report-To headers auto-attached by CDNs pointing at endpoints you don't control
• Security/QA consultants - one-shot observability header check that slots into existing header-audit workflows
• Pre-deploy QA - catch the classic mistake of setting only Reporting-Endpoints, which does not support NEL (it works only with the legacy Report-To pipeline)

What it checks

• NEL header: valid JSON, required report_to and max_age, boolean include_subdomains, failure_fraction/success_fraction in 0-1, unknown keys, too-short max_age
• Report-To header (legacy pipeline, required by NEL): group names, max_age, endpoints arrays, https endpoint URLs, duplicate group definitions
• Reporting-Endpoints header (new pipeline): name="url" entries, https URLs, duplicate names
• Wiring: NEL report_to must reference a defined Report-To group (dangling references drop reports silently)
• Pipeline awareness: warns when only Reporting-Endpoints is set — NEL does not work with the new pipeline
• Report endpoints: https-only URLs, parse validity, and spec-forbidden report loops (endpoints resolving back to the audited origin)

Report endpoints found in headers are never fetched or POSTed to — they are validated as URL strings only, so this actor cannot be used to flood report collectors.

Input

Field	Type	Required	Default	Description
startUrl	string	yes	-	Public URL to audit
timeoutSeconds	integer	no	10	Per-request timeout (3-30 seconds)

Example input

{
  "startUrl": "https://example.com",
  "timeoutSeconds": 10
}

Output

A single dataset item with the full audit:

Field	Type	Description
inputUrl	string	The URL provided as input
finalUrl	string	Final URL after redirects
https	boolean	Whether the final response was served over HTTPS
status	integer	Final HTTP status code
hasNel	boolean	Whether the NEL header is present
hasReportTo	boolean	Whether the legacy Report-To header is present
hasReportingEndpoints	boolean	Whether the new Reporting-Endpoints header is present
nel	object	Parsed NEL policy (reportTo, maxAge, includeSubdomains, failureFraction, successFraction, issues)
reportTo	object	Parsed Report-To groups, endpoints, and issues
reportingEndpoints	array	Parsed Reporting-Endpoints named endpoint list
danglingReportTo	boolean	NEL references a report_to group not defined in Report-To
reportLoop	boolean	A report endpoint resolves back to the audited origin (spec violation)
maxAge	integer | null	Parsed NEL max_age (seconds)
includeSubdomains	boolean	NEL include_subdomains flag
endpointCount	integer	Total distinct report endpoints across headers
httpsEndpointCount	integer	Report endpoints using https
checks	array	Per-check analysis (name, status, note, weight, recommendation)
issues	array	Aggregated issue descriptions
score	integer	NEL/Reporting readiness score (0-100)
grade	string	Letter grade (A+, A, B, C, D, E, F)
checkedAt	string	ISO 8601 timestamp
recommendations	array	Actionable recommendations

checks array

Field	Description
name	Check title (NEL header, Report-To header, Reporting-Endpoints header, NEL-to-Report-To wiring, Legacy vs new pipeline, Report endpoints)
check	Check slug
status	good, warn, missing, or info
note	What was found
weight	Check weight in the score
recommendation	Fix recommendation, or null

Security

• Public HTTP/HTTPS only; rejects URL credentials, private IP literals, private DNS resolutions, and revalidates redirects before following.
• Fetches only the provided URL's response headers; report endpoints found in headers are never fetched or POSTed to.
• No login, no JavaScript execution, no cookies, no stored page content.

Pricing

Pay-per-event: one scored audit per run (~$0.015/run).

Local development

npm install
npm test        # node --test suite (parsers, SSRF, scoring, live smoke)
npm run lint    # node --check
python3 ../scripts/audit_actor.py .   # portfolio security audit (run from actors/ dir)