test/integration/csp_header_test.rb


1
2
3
4
5
6
7
8
9
10
11
12

require 'test_helper'

class CspHeaderTest < ActionDispatch::IntegrationTest
  test "public responses carry the report-only CSP header with a nonce" do
    get "/"

    header = response.headers["Content-Security-Policy-Report-Only"]
    assert header.present?
    assert_includes header, "script-src"
    assert_includes header, "nonce-"
  end
end