FIX: Mini-profiler CSP nonce when in report-only mode (#28664)

2024-09-02 10:04:47 +01:00 · 2024-09-02 10:04:47 +01:00 · 3fb3ef7c85
parent b7164f1283
commit 3fb3ef7c85
1 changed files with 1 additions and 1 deletions
--- a/config/initializers/006-mini_profiler.rb
+++ b/config/initializers/006-mini_profiler.rb
@ -90,7 +90,7 @@ if defined?(Rack::MiniProfiler) && defined?(Rack::MiniProfiler::Config)

  Rack::MiniProfiler.config.content_security_policy_nonce =
    Proc.new do |env, headers|
-      if csp = headers["Content-Security-Policy"]
+      if csp = headers["Content-Security-Policy"] || headers["Content-Security-Policy-Report-Only"]
        csp[/script-src[^;]+'nonce-([^']+)'/, 1]
      end
    end