title: Content Security Policy not loading content over HTTPS
body: <p>I am using Content Security Policy and I am having trouble loading stylesheets, images and javascript over HTTPS</p>
  
  <p>It all works fine over HTTP but as soon I get a page over HTTPS I get errors in the Chrome console like this</p>
  
  <blockquote>
    <p>Refused to load the stylesheet
    '<a href="http://my-domain/public/css/bootstrap.min.css" rel="nofollow">http://my-domain/public/css/bootstrap.min.css</a>' because it violates
    the following Content Security Policy directive: "style-src 'self'
    <a href="https://maxcdn.bootstrapcdn.com" rel="nofollow">https://maxcdn.bootstrapcdn.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a>
    <a href="https://fonts.googleapis.com" rel="nofollow">https://fonts.googleapis.com</a>
    'nonce-SLkcvNDK0InbqoywRHBvWE9qYBDXLlmu'".        login: 1</p>
  </blockquote>
  
  <p>which points to</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  </code></pre>
  
  <p>Here is how my headers are created</p>
  
  <pre><code>// Set a sample rule
  $csp_rules = "default-src 'self'; script-src 'self' 'nonce-".RANDOM."' https://ajax.googleapis.com https://maxcdn.bootstrapcdn.com https://connect.facebook.net; style-src 'self' https://maxcdn.bootstrapcdn.com https://ajax.googleapis.com https://fonts.googleapis.com 'nonce-".RANDOM."'; font-src 'self' https://maxcdn.bootstrapcdn.com https://fonts.gstatic.com; img-src 'self' https://ajax.googleapis.com; frame-src https://s-static.ak.facebook.com https://www.facebook.com;";
  
  foreach (array("X-WebKit-CSP", "X-Content-Security-Policy", "Content-Security-Policy") as $csp){
      header($csp . ": " . $csp_rules);
  }
  
  // Provides Clickjacking protection.
  header('X-Frame-Options: deny');
  // This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
  header('X-XSS-Protection: 1; mode=block');
  // Pevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. 
  header('X-Content-Type-Options: nosniff');
  </code></pre>
  
  <p>Do I need to add anything to the rule or could it be something else?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Here is how the stylesheet link looks like in the source</p>
  
  <pre><code>&lt;link rel="stylesheet" href="https://my-domain/public/css/bootstrap.min.css"&gt;
  </code></pre>