I'm not sure the status with Site Isolation and whether this might allow for cross-origin exhaustion/blocking of CSP reports, since the limit is per-renderer process.

I'm also not sure whether we should be rethinking how the keepalive implementation is structured. Right now, the Keepalive handle is rate limited, as it will keep the renderer alive. This means that even under normal renderer operation, the number of keepalive requests gets throttled. I wonder if it makes more sense to treat the keepalive requests that, under normal operation, are dispatched as-is, but once a renderer signals intent to shut-down, we no longer allow new requests to be issued and begin reaping handles, such that only X requests for Y seconds post-shutdown are permitted. For the situation of CSP load, this would allow all of the reports to be dispatched, provided that the renderer isn't navigated away/killed, while limiting the number of pending reports if they are.

I think the limit is 20, not 10.

Do we have data that would help us understand what the limit should be?
Was it unlimited before?

kenjibaheux@: It was practically unlimited before the change, yes.

Short-term, would it be enough to remove the `request.SetKeepalive(true)` line from `PingLoader::SendViolationReport` be enough to prevent these reports from violating the keepalive-per-process limit? That would introduce the new problem of dropping some reports when the page dies, but that might be a reasonable tradeoff while cleverer folks come up with a queuing mechanism that makes sense?

We (https://report-uri.com) can regularly see upwards of 50 reports for a given page load when customers are using the CSP Wizard: https://scotthelme.co.uk/report-uri-csp-wizard/

By design it blocks everything in a Report-Only policy to give us full visibility of everything on the page by sending a report, which allows us to build a policy for the user. This is why we first started noticing it as customers drop a huge chunk of reports in many scenarios resulting in reduced coverage.

I'm not sure we can or should go to unlimited but a limit like 100 would certainly cover the vast majority of cases we've seen.