1 files changed, 12 insertions, 0 deletions

diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb
new file mode 100644
index 0000000..73707ed
--- /dev/null
+++ b/test/integration/csp_header_test.rb
@@ -0,0 +1,12 @@
+require 'test_helper'
+
+class CspHeaderTest < ActionDispatch::IntegrationTest
+  test "public responses carry the report-only CSP header with a nonce" do
+    get "/"
+
+    header = response.headers["Content-Security-Policy-Report-Only"]
+    assert header.present?
+    assert_includes header, "script-src"
+    assert_includes header, "nonce-"
+  end
+end