Content Security Policy violation details missing on report-uri
<p>Chrome is reporting Content Security Policy violations to the <code>report-uri</code>, but it reports no violation details. It reports <code>{}</code> instead of providing details regarding the violated policy.  All other browsers seem to be reporting violation details fine. My policy is provided below.</p>

<p><strong>I've tried...</strong></p>

<ol>
<li>putting the full absolute path in the <code>report-uri</code> directive. </li>
<li>taking the policy out of <code>Report-Only</code> mode</li>
<li>making the policy much simpler e.g. <code>default-src 'none' ; report-uri /api/csp-report;</code></li>
<li>turning off all my extensions (although I am seeing this in a production site from win &amp; osx visitors with chrome)</li>
<li>testing in Canary</li>
<li>"Reported an issue" in chrome (I'm guessing it hasn't even been triaged yet)</li>
</ol>

<p><strong>Questions I haven't found an answer for yet</strong></p>

<ol>
<li>Is this implemented in Chrome yet?</li>
<li>Does the implementation differ from the spec?</li>
</ol>

<p><strong>The Policy (Delivered via HTTP Header)</strong></p>

<blockquote>
  <p>Content-Security-Policy-Report-Only: default-src 'none' ; script-src
  'self' 'unsafe-eval' <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a>; style-src
  'self' 'unsafe-inline' <a href="https://fonts.googleapis.com" rel="nofollow">https://fonts.googleapis.com</a>; img-src 'self'
  <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> ; font-src 'self'
  <a href="https://fonts.gstatic.com" rel="nofollow">https://fonts.gstatic.com</a>; connect-src 'self'
  <a href="https://api.servicesite.com" rel="nofollow">https://api.servicesite.com</a>; frame-src 'none' ; child-src 'none' ;
  frame-ancestors 'none' ; form-action 'self' ;
  upgrade-insecure-requests; block-all-mixed-content; reflected-xss
  block; base-uri https://*.mysite.com; referrer
  origin-when-cross-origin; report-uri /api/csp-report;</p>
</blockquote>

<h2>Update... Mar-16-2016</h2>

<ul>
<li>Chrome is sending the report. I see the request body in network tab. Also logging it in intermediary nginx proxy.</li>
</ul>

<p>That leads me to think this is a parsing issue in my receiving code (node, express using body-parser). However, still confounded as to why this would only happen for Chrome CSP reports. All other browser's reports pass though just fine.</p>