fix: CSP header is not emitted when $autoNonce is false

Author: kenjis

system/HTTP/ContentSecurityPolicy.php

@@ -300,11 +300,10 @@ public function getScriptNonce(): string
      */
     public function finalize(ResponseInterface $response)
     {
-        if ($this->autoNonce === false) {
-            return;
+        if ($this->autoNonce) {
+            $this->generateNonces($response);
         }
 
-        $this->generateNonces($response);
         $this->buildHeaders($response);
     }
 

tests/system/HTTP/ContentSecurityPolicyTest.php

@@ -533,6 +533,9 @@ public function testBodyScriptNonceDisableAutoNonce()
         $csp->finalize($response);
 
         $this->assertStringContainsString('{csp-script-nonce}', $response->getBody());
+
+        $result = new \CodeIgniter\Test\TestResponse($response);
+        $result->assertHeader('Content-Security-Policy');
     }
 
     public function testBodyStyleNonceDisableAutoNonce()
@@ -549,6 +552,9 @@ public function testBodyStyleNonceDisableAutoNonce()
         $csp->finalize($response);
 
         $this->assertStringContainsString('{csp-style-nonce}', $response->getBody());
+
+        $result = new \CodeIgniter\Test\TestResponse($response);
+        $result->assertHeader('Content-Security-Policy');
     }
 
     /**