private function updateCspHeaders(Response $response, array $nonces = [])
    {
        $nonces = array_replace([
            'csp_script_nonce' => $this->generateNonce(),
            'csp_style_nonce' => $this->generateNonce(),
        ], $nonces);

        $ruleIsSet = false;

        $headers = $this->getCspHeaders($response);

        foreach ($headers as $header => $directives) {
            foreach (['script-src' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce'] as $type => $tokenName) {
                if ($this->authorizesInline($directives, $type)) {
                    continue;
                }
                if (!isset($headers[$header][$type])) {
                    if (isset($headers[$header]['default-src'])) {
                        $headers[$header][$type] = $headers[$header]['default-src'];
                    } else {
                        // If there is no script-src/style-src and no default-src, no additional rules required.
                        continue;
                    }
                }
                $ruleIsSet = true;
                if (!\in_array('\'unsafe-inline\'', $headers[$header][$type], true)) {
                    $headers[$header][$type][] = '\'unsafe-inline\'';
                }
                $headers[$header][$type][] = sprintf('\'nonce-%s\'', $nonces[$tokenName]);
            }
        }

        if (!$ruleIsSet) {
            return $nonces;
        }

        foreach ($headers as $header => $directives) {
            $response->headers->set($header, $this->generateCspHeader($directives));
        }

        return $nonces;
    }
private function updateCspHeaders(Response $response, array $nonces = [])
    {
        $nonces = array_replace([
            'csp_script_nonce' => $this->generateNonce(),
            'csp_style_nonce' => $this->generateNonce(),
        ], $nonces);

        $ruleIsSet = false;

        $headers = $this->getCspHeaders($response);

        foreach ($headers as $header => $directives) {
            foreach (['script-src' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce'] as $type => $tokenName) {
                if ($this->authorizesInline($directives, $type)) {
                    continue;
                }
                if (!isset($headers[$header][$type])) {
                    if (isset($headers[$header]['default-src'])) {
                        $headers[$header][$type] = $headers[$header]['default-src'];
                    } else {
                        // If there is no script-src/style-src and no default-src, no additional rules required.
                        continue;
                    }
                }
                $ruleIsSet = true;
                if (!\in_array('\'unsafe-inline\'', $headers[$header][$type], true)) {
                    $headers[$header][$type][] = '\'unsafe-inline\'';
                }
                $headers[$header][$type][] = sprintf('\'nonce-%s\'', $nonces[$tokenName]);
            }
        }

        if (!$ruleIsSet) {
            return $nonces;
        }

        foreach ($headers as $header => $directives) {
            $response->headers->set($header, $this->generateCspHeader($directives));
        }

        return $nonces;
    }
private function updateCspHeaders ( Response $ response , array $ nonces = [ ] ) { $ nonces = array_replace ( [ 'csp_script_nonce' => $ this -> generateNonce ( ) , 'csp_style_nonce' => $ this -> generateNonce ( ) , ] , $ nonces ) ; $ ruleIsSet = false ; $ headers = $ this -> getCspHeaders ( $ response ) ; foreach ( $ headers as $ header => $ directives ) { foreach ( [ 'script-src' => 'csp_script_nonce' , 'style-src' => 'csp_style_nonce' ] as $ type => $ tokenName ) { if ( $ this -> authorizesInline ( $ directives , $ type ) ) { continue ; } if ( ! isset ( $ headers [ $ header ] [ $ type ] ) ) { if ( isset ( $ headers [ $ header ] [ 'default-src' ] ) ) { $ headers [ $ header ] [ $ type ] = $ headers [ $ header ] [ 'default-src' ] ; } else { // If there is no script-src/style-src and no default-src, no additional rules required. continue ; } } $ ruleIsSet = true ; if ( ! \ in_array ( '\'unsafe-inline\'' , $ headers [ $ header ] [ $ type ] , true ) ) { $ headers [ $ header ] [ $ type ] [ ] = '\'unsafe-inline\'' ; } $ headers [ $ header ] [ $ type ] [ ] = sprintf ( '\'nonce-%s\'' , $ nonces [ $ tokenName ] ) ; } } if ( ! $ ruleIsSet ) { return $ nonces ; } foreach ( $ headers as $ header => $ directives ) { $ response -> headers -> set ( $ header , $ this -> generateCspHeader ( $ directives ) ) ; } return $ nonces ; }
Updates Content-Security-Policy headers in a response.

@return array
Updates Content - Security - Policy headers in a response .