Skip to content

fix: apply ContentSecurityPolicy::reportOnly() to config sources after construction - #10663

Open
paulbalandan wants to merge 1 commit into
codeigniter4:developfrom
paulbalandan:csp-report-only-config-sources
Open

paulbalandan wants to merge 1 commit into
codeigniter4:developfrom
paulbalandan:csp-report-only-config-sources

Conversation

@paulbalandan

Copy link
Copy Markdown
Member

Description
Fixes #10662 .

A regression from #9904 . Previously, the $reportOnly flag was enforced early on construction of the class, thus any subsequent reportOnly(true) were effectively ignored. The fix now uses null on construction then checks $reportOnly on build.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@carson-codeigniter4 carson-codeigniter4 Bot added the bug Verified issues on the current code behavior or pull requests that will fix them label Oct 26, 2026

@michalsn michalsn left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Verified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Content-Security-Policy: Both Report-Only and Non Report-Only headers are sent to browser after calling response->getCSP()->reportOnly(true)

2 participants