reproduction repo: https://github.com/predaytor/fresh-project-csp-middleware-bug
import { csp } from "fresh";
// nonce missing but header set
// app.use(csp({ useNonce: true }));
app.get('/', (ctx) => {
return ctx.render(
<html>
<head>
<style>{'body { color: red; }'}</style>
</head>
<body>
<h1>Hello</h1>
</body>
</html>,
);
});
// works, but `content-security-header` is not set
app.use(csp({ useNonce: true }));
reproduction repo: https://github.com/predaytor/fresh-project-csp-middleware-bug