Nielsen audit pings check HTTPS and browser transport.

Nielsen documents HTTPS audit pings and prefers simple GET requests because downstream collectors reject browser preflight. Captured requests can receive advice for MIME types, raw unsafe header bytes and the 128-byte Content-Type safelist bound.

Content-Type advice requires captured cross-origin context. Missing, redacted and unsupported Origin values preserve that uncertainty. No Origin or Content-Type header is required. These checks do not certify complete CORS behavior or delivery.

What this pack matches

Hosts: audit.imrworldwide.com
Paths: /cgi-bin/gn
Vendor docs: engineeringportal.nielsen.com/wiki/Digital_Measurement_Ads_Audit_Beacon

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`prd`	required	It marks the request as an audit ping. Nielsen documents the ads audit URL as /cgi-bin/gn?prd=audit. Fix: Set prd=audit on every ads audit ping.	`vendor.nielsen-audit.param.prd.missing` `vendor.nielsen-audit.param.prd.empty` `vendor.nielsen-audit.param.prd.invalid`	docs
`intid`	required	It is the integration ID Nielsen assigns for all audit pings across platforms. Fix: Set intid to the integration ID Nielsen issued.	`vendor.nielsen-audit.param.intid.missing` `vendor.nielsen-audit.param.intid.empty`	docs
`sessionid`	required	It is the session ID generated when the player is instantiated. Nielsen documents it as mandatory. Fix: Send a stable sessionid for the playback session, and fire again if it changes.	`vendor.nielsen-audit.param.sessionid.missing` `vendor.nielsen-audit.param.sessionid.empty` `vendor.nielsen-audit.param.sessionid.invalid`	docs
`product`	required	It names the Nielsen product the ping corresponds to. Nielsen documents examples dar, dcr, and dtvr. Fix: Set product to the Nielsen product for this integration, such as dar, dcr, or dtvr.	`vendor.nielsen-audit.param.product.missing` `vendor.nielsen-audit.param.product.empty` `vendor.nielsen-audit.param.product.invalid`	docs
`createtm`	required	It is the time the ping was fired. Nielsen documents createtm as Unix time. Fix: Set createtm to the Unix timestamp when the ping fired, such as 1643858542.	`vendor.nielsen-audit.param.createtm.missing` `vendor.nielsen-audit.param.createtm.empty` `vendor.nielsen-audit.param.createtm.invalid`	docs
`apid`	optional	It is the Nielsen Server App ID. Nielsen documents apid as required only for content measurement. Fix: Send apid when this audit ping is for content measurement.	`vendor.nielsen-audit.param.apid.empty`	docs
`content_app_id_required`	required	Nielsen requires its Server App ID for content measurement audit pings.	`vendor.nielsen-audit.content_app_id_required`	docs
`https_required`	required	Nielsen documents audit pings as HTTPS requests. Fix: Use https://audit.imrworldwide.com/cgi-bin/gn with the generated audit parameters.	`vendor.nielsen-audit.https_required`	docs
`method`	recommended	Nielsen prefers simple GET audit requests to avoid preflight. This is advice rather than a universal receiver method enumeration. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.nielsen-audit.http.method.missing` `vendor.nielsen-audit.http.method.empty` `vendor.nielsen-audit.http.method.invalid`	docs
`headers.origin`	optional	Capture context for cross-origin browser transport advice. No Origin header is required and its syntax is not newly constrained. Complete HTTP capture contract.		docs
`content_type`	optional	For a captured request carrying a non-collector Origin, these MIME essences are CORS-safelisted. A different media type can require preflight, which Nielsen warns its downstream collectors reject. Header absence is allowed. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"present","param":"headers.origin"},{"kind":"value_pattern","param":"headers.origin","pattern":"(?i)^(?:null\|https?://[^/?#\\s]+)$"},{"kind":"not","condition":{"kind":"value_pattern","param":"headers.origin","pattern":"(?i)^https://audit\\.imrworldwide\\.com(?::443)?$"}}]}. Presence diagnostic severity: warning. Evidence: formal standard. Fix: For browser cross-origin audit GETs, omit Content-Type or use a CORS-safelisted media type, such as text/plain.	`vendor.nielsen-audit.http.content_type.empty` `vendor.nielsen-audit.http.content_type.invalid`	docs
`headers.content-type`	optional	Fetch limits a CORS-safelisted Content-Type value to 128 bytes and excludes CORS-unsafe bytes. For a captured Latin-1 header value each character is one byte, including MIME parameters. Values outside Latin-1 remain unverified by this raw-header advice. This does not certify the complete browser preflight decision. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"all","conditions":[{"kind":"present","param":"headers.origin"},{"kind":"value_pattern","param":"headers.origin","pattern":"(?i)^(?:null\|https?://[^/?#\\s]+)$"},{"kind":"not","condition":{"kind":"value_pattern","param":"headers.origin","pattern":"(?i)^https://audit\\.imrworldwide\\.com(?::443)?$"}}]},{"kind":"value_pattern","param":"headers.content-type","pattern":"^[\\x00-\\xff]*$"}]}. Presence diagnostic severity: warning. Evidence: formal standard. Maximum decoded characters: 128. Fix: Use a short Content-Type value without CORS-unsafe bytes. For this audit GET, the header may also be omitted.	`vendor.nielsen-audit.http.headers.content-type.empty` `vendor.nielsen-audit.http.headers.content-type.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/nielsen-audit

Try this failing payload in the playground. A cross-origin Nielsen audit request with a preflight-triggering MIME type.

{
  "url": "https://audit.imrworldwide.com/cgi-bin/gn?prd=audit&intid=synthetic&sessionid=Session123&product=dar&createtm=1792600000",
  "method": "GET",
  "headers": {
    "Origin": "https://publisher.example.test",
    "Content-Type": "application/json"
  }
}

cargo install pixellint · npm install pixellint