secure_headers 3.6.7 → 4.0.0

data/spec/lib/secure_headers/headers/x_xss_protection_spec.rb

@@ -1,9 +1,10 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe XXssProtection do
     specify { expect(XXssProtection.make_header).to eq([XXssProtection::HEADER_NAME, XXssProtection::DEFAULT_VALUE]) }
-    specify { expect(XXssProtection.make_header("1; mode=block; report=https://www.secure.com/reports")).to eq([XXssProtection::HEADER_NAME, '1; mode=block; report=https://www.secure.com/reports']) }
+    specify { expect(XXssProtection.make_header("1; mode=block; report=https://www.secure.com/reports")).to eq([XXssProtection::HEADER_NAME, "1; mode=block; report=https://www.secure.com/reports"]) }
 
     context "with invalid configuration" do
       it "should raise an error when providing a string that is not valid" do
@@ -19,7 +20,7 @@ module SecureHeaders
       context "when using a hash value" do
         it "should allow string values ('1' or '0' are the only valid strings)" do
           expect do
-            XXssProtection.validate_config!('1')
+            XXssProtection.validate_config!("1")
           end.not_to raise_error
         end
 

data/spec/lib/secure_headers/middleware_spec.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "spec_helper"
 
 module SecureHeaders
@@ -19,8 +20,8 @@ module SecureHeaders
         config.hpkp = {
           max_age: 10000000,
           pins: [
-            {sha256: 'b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c'},
-            {sha256: '73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f'}
+            {sha256: "b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c"},
+            {sha256: "73a2c64f9545172c1195efb6616ca5f7afd1df6f245407cafb90de3998a1c97f"}
           ],
           report_uri: "https://#{report_host}/example-hpkp"
         }
@@ -54,68 +55,75 @@ module SecureHeaders
       expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match("example.org")
     end
 
-    context "secure_cookies" do
+    context "cookies" do
       context "cookies should be flagged" do
         it "flags cookies as secure" do
-          capture_warning do
-            Configuration.default { |config| config.secure_cookies = true }
-          end
+          Configuration.default { |config| config.cookies = {secure: true, httponly: OPT_OUT, samesite: OPT_OUT} }
           request = Rack::Request.new("HTTPS" => "on")
           _, env = cookie_middleware.call request.env
-          expect(env['Set-Cookie']).to eq("foo=bar; secure")
+          expect(env["Set-Cookie"]).to eq("foo=bar; secure")
         end
       end
 
+      it "allows opting out of cookie protection with OPT_OUT alone" do
+        Configuration.default { |config| config.cookies = OPT_OUT}
+
+        # do NOT make this request https. non-https requests modify a config,
+        # causing an exception when operating on OPT_OUT. This ensures we don't
+        # try to modify the config.
+        request = Rack::Request.new({})
+        _, env = cookie_middleware.call request.env
+        expect(env["Set-Cookie"]).to eq("foo=bar")
+      end
+
       context "cookies should not be flagged" do
         it "does not flags cookies as secure" do
-          capture_warning do
-            Configuration.default { |config| config.secure_cookies = false }
-          end
+          Configuration.default { |config| config.cookies = {secure: OPT_OUT, httponly: OPT_OUT, samesite: OPT_OUT}  }
           request = Rack::Request.new("HTTPS" => "on")
           _, env = cookie_middleware.call request.env
-          expect(env['Set-Cookie']).to eq("foo=bar")
+          expect(env["Set-Cookie"]).to eq("foo=bar")
         end
       end
     end
 
     context "cookies" do
       it "flags cookies from configuration" do
-        Configuration.default { |config| config.cookies = { secure: true, httponly: true } }
+        Configuration.default { |config| config.cookies = { secure: true, httponly: true, samesite: { lax: true} } }
         request = Rack::Request.new("HTTPS" => "on")
         _, env = cookie_middleware.call request.env
 
-        expect(env['Set-Cookie']).to eq("foo=bar; secure; HttpOnly")
+        expect(env["Set-Cookie"]).to eq("foo=bar; secure; HttpOnly; SameSite=Lax")
       end
 
       it "flags cookies with a combination of SameSite configurations" do
         cookie_middleware = Middleware.new(lambda { |env| [200, env.merge("Set-Cookie" => ["_session=foobar", "_guest=true"]), "app"] })
 
-        Configuration.default { |config| config.cookies = { samesite: { lax: { except: ["_session"] }, strict: { only: ["_session"] } } } }
+        Configuration.default { |config| config.cookies = { samesite: { lax: { except: ["_session"] }, strict: { only: ["_session"] } }, httponly: OPT_OUT, secure: OPT_OUT} }
         request = Rack::Request.new("HTTPS" => "on")
         _, env = cookie_middleware.call request.env
 
-        expect(env['Set-Cookie']).to match("_session=foobar; SameSite=Strict")
-        expect(env['Set-Cookie']).to match("_guest=true; SameSite=Lax")
+        expect(env["Set-Cookie"]).to match("_session=foobar; SameSite=Strict")
+        expect(env["Set-Cookie"]).to match("_guest=true; SameSite=Lax")
       end
 
       it "disables secure cookies for non-https requests" do
-        Configuration.default { |config| config.cookies = { secure: true } }
+        Configuration.default { |config| config.cookies = { secure: true, httponly: OPT_OUT, samesite: OPT_OUT } }
 
         request = Rack::Request.new("HTTPS" => "off")
         _, env = cookie_middleware.call request.env
-        expect(env['Set-Cookie']).to eq("foo=bar")
+        expect(env["Set-Cookie"]).to eq("foo=bar")
       end
 
       it "sets the secure cookie flag correctly on interleaved http/https requests" do
-        Configuration.default { |config| config.cookies = { secure: true } }
+        Configuration.default { |config| config.cookies = { secure: true, httponly: OPT_OUT, samesite: OPT_OUT } }
 
         request = Rack::Request.new("HTTPS" => "off")
         _, env = cookie_middleware.call request.env
-        expect(env['Set-Cookie']).to eq("foo=bar")
+        expect(env["Set-Cookie"]).to eq("foo=bar")
 
         request = Rack::Request.new("HTTPS" => "on")
         _, env = cookie_middleware.call request.env
-        expect(env['Set-Cookie']).to eq("foo=bar; secure")
+        expect(env["Set-Cookie"]).to eq("foo=bar; secure")
       end
     end
   end

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "spec_helper"
 require "erb"
 
@@ -58,7 +59,7 @@ TEMPLATE
     end
 
     if options.is_a?(Hash)
-      options = options.map {|k,v| " #{k}=#{v}"}
+      options = options.map {|k, v| " #{k}=#{v}"}
     end
     "<#{type}#{options}>#{content}</#{type}>"
   end
@@ -82,9 +83,9 @@ module SecureHeaders
     before(:all) do
       Configuration.default do |config|
         config.csp = {
-          :default_src => %w('self'),
-          :script_src => %w('self'),
-          :style_src => %w('self')
+          default_src: %w('self'),
+          script_src: %w('self'),
+          style_src: %w('self')
         }
       end
     end

data/spec/lib/secure_headers_spec.rb

@@ -1,4 +1,5 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe SecureHeaders do
@@ -30,16 +31,16 @@ module SecureHeaders
     describe "#header_hash_for" do
       it "allows you to opt out of individual headers via API" do
         Configuration.default do |config|
-          config.csp = { default_src: %w('self')}
+          config.csp = { default_src: %w('self'), script_src: %w('self')}
           config.csp_report_only = config.csp
         end
         SecureHeaders.opt_out_of_header(request, ContentSecurityPolicyConfig::CONFIG_KEY)
         SecureHeaders.opt_out_of_header(request, ContentSecurityPolicyReportOnlyConfig::CONFIG_KEY)
         SecureHeaders.opt_out_of_header(request, XContentTypeOptions::CONFIG_KEY)
         hash = SecureHeaders.header_hash_for(request)
-        expect(hash['Content-Security-Policy-Report-Only']).to be_nil
-        expect(hash['Content-Security-Policy']).to be_nil
-        expect(hash['X-Content-Type-Options']).to be_nil
+        expect(hash["Content-Security-Policy-Report-Only"]).to be_nil
+        expect(hash["Content-Security-Policy"]).to be_nil
+        expect(hash["X-Content-Type-Options"]).to be_nil
       end
 
       it "Carries options over when using overrides" do
@@ -54,15 +55,15 @@ module SecureHeaders
 
         SecureHeaders.use_secure_headers_override(request, :api)
         hash = SecureHeaders.header_hash_for(request)
-        expect(hash['X-Download-Options']).to be_nil
-        expect(hash['X-Permitted-Cross-Domain-Policies']).to be_nil
-        expect(hash['X-Frame-Options']).to be_nil
+        expect(hash["X-Download-Options"]).to be_nil
+        expect(hash["X-Permitted-Cross-Domain-Policies"]).to be_nil
+        expect(hash["X-Frame-Options"]).to be_nil
       end
 
       it "allows you to opt out entirely" do
         # configure the disabled-by-default headers to ensure they also do not get set
         Configuration.default do |config|
-          config.csp = { :default_src => ["example.com"] }
+          config.csp = { default_src: ["example.com"], script_src: %w('self') }
           config.csp_report_only = config.csp
           config.hpkp = {
             report_only: false,
@@ -108,6 +109,7 @@ module SecureHeaders
         Configuration.default do |config|
           config.csp = {
             default_src: %w('self'),
+            script_src: %w('self'),
             child_src: %w('self')
           }
         end
@@ -144,10 +146,10 @@ module SecureHeaders
           config.hpkp = {
             max_age: 1_000_000,
             include_subdomains: true,
-            report_uri: '//example.com/uri-directive',
+            report_uri: "//example.com/uri-directive",
             pins: [
-              { sha256: 'abc' },
-              { sha256: '123' }
+              { sha256: "abc" },
+              { sha256: "123" }
             ]
           }
         end
@@ -173,42 +175,32 @@ module SecureHeaders
           expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline' anothercdn.com")
         end
 
-        it "appends child-src to frame-src" do
+        it "child-src and frame-src must match" do
           Configuration.default do |config|
             config.csp = {
               default_src: %w('self'),
-              frame_src: %w(frame_src.com)
+              frame_src: %w(frame_src.com),
+              script_src: %w('self')
             }
           end
 
           SecureHeaders.append_content_security_policy_directives(chrome_request, child_src: %w(child_src.com))
-          hash = SecureHeaders.header_hash_for(chrome_request)
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; child-src frame_src.com child_src.com")
-        end
-
-        it "appends frame-src to child-src" do
-          Configuration.default do |config|
-            config.csp = {
-              default_src: %w('self'),
-              child_src: %w(child_src.com)
-            }
-          end
 
-          safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari6]))
-          SecureHeaders.append_content_security_policy_directives(safari_request, frame_src: %w(frame_src.com))
-          hash = SecureHeaders.header_hash_for(safari_request)
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; frame-src child_src.com frame_src.com")
+          expect {
+            SecureHeaders.header_hash_for(chrome_request)
+          }.to raise_error(ArgumentError)
         end
 
         it "supports named appends" do
           Configuration.default do |config|
             config.csp = {
-              default_src: %w('self')
+              default_src: %w('self'),
+              script_src: %w('self')
             }
           end
 
           Configuration.named_append(:moar_default_sources) do |request|
-            { default_src: %w(https:)}
+            { default_src: %w(https:), style_src: %w('self')}
           end
 
           Configuration.named_append(:how_about_a_script_src_too) do |request|
@@ -219,13 +211,14 @@ module SecureHeaders
           SecureHeaders.use_content_security_policy_named_append(request, :how_about_a_script_src_too)
           hash = SecureHeaders.header_hash_for(request)
 
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self' https:; script-src 'self' https: 'unsafe-inline'")
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self' https:; script-src 'self' 'unsafe-inline'; style-src 'self'")
         end
 
         it "appends a nonce to a missing script-src value" do
           Configuration.default do |config|
             config.csp = {
-              default_src: %w('self')
+              default_src: %w('self'),
+              script_src: %w('self')
             }
           end
 
@@ -237,7 +230,8 @@ module SecureHeaders
         it "appends a hash to a missing script-src value" do
           Configuration.default do |config|
             config.csp = {
-              default_src: %w('self')
+              default_src: %w('self'),
+              script_src: %w('self')
             }
           end
 
@@ -249,24 +243,26 @@ module SecureHeaders
         it "overrides individual directives" do
           Configuration.default do |config|
             config.csp = {
-              default_src: %w('self')
+              default_src: %w('self'),
+              script_src: %w('self')
             }
           end
           SecureHeaders.override_content_security_policy_directives(request, default_src: %w('none'))
           hash = SecureHeaders.header_hash_for(request)
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'none'")
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'none'; script-src 'self'")
         end
 
         it "overrides non-existant directives" do
           Configuration.default do |config|
             config.csp = {
-              default_src: %w(https:)
+              default_src: %w(https:),
+              script_src: %w('self')
             }
           end
           SecureHeaders.override_content_security_policy_directives(request, img_src: [ContentSecurityPolicy::DATA_PROTOCOL])
           hash = SecureHeaders.header_hash_for(request)
           expect(hash[ContentSecurityPolicyReportOnlyConfig::HEADER_NAME]).to be_nil
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src https:; img-src data:")
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src https:; img-src data:; script-src 'self'")
         end
 
         it "does not append a nonce when the browser does not support it" do
@@ -301,7 +297,7 @@ module SecureHeaders
           SecureHeaders.content_security_policy_script_nonce(chrome_request)
 
           hash = SecureHeaders.header_hash_for(chrome_request)
-          expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'; style-src 'self'")
+          expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'; style-src 'self'")
         end
 
         it "uses a nonce for safari 10+" do
@@ -315,25 +311,18 @@ module SecureHeaders
           safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari10]))
           nonce = SecureHeaders.content_security_policy_script_nonce(safari_request)
           hash = SecureHeaders.header_hash_for(safari_request)
-          expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'")
+          expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'")
         end
 
-        it "supports the deprecated `report_only: true` format" do
-          expect(Kernel).to receive(:warn).once
-
-          Configuration.default do |config|
-            config.csp = {
-              default_src: %w('self'),
-              report_only: true
-            }
-          end
-
-          expect(Configuration.get.csp).to eq(OPT_OUT)
-          expect(Configuration.get.csp_report_only).to be_a(ContentSecurityPolicyReportOnlyConfig)
-
-          hash = SecureHeaders.header_hash_for(request)
-          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to be_nil
-          expect(hash[ContentSecurityPolicyReportOnlyConfig::HEADER_NAME]).to eq("default-src 'self'")
+        it "does not support the deprecated `report_only: true` format" do
+          expect {
+            Configuration.default do |config|
+              config.csp = {
+                default_src: %w('self'),
+                report_only: true
+              }
+            end
+          }.to raise_error(ArgumentError)
         end
 
         it "Raises an error if csp_report_only is used with `report_only: false`" do
@@ -341,6 +330,7 @@ module SecureHeaders
             Configuration.default do |config|
               config.csp_report_only = {
                 default_src: %w('self'),
+                script_src: %w('self'),
                 report_only: false
               }
             end
@@ -351,7 +341,8 @@ module SecureHeaders
           before(:each) do
             Configuration.default do |config|
               config.csp = {
-                default_src: %w('self')
+                default_src: %w('self'),
+                script_src: %w('self')
               }
               config.csp_report_only = config.csp
             end
@@ -360,155 +351,136 @@ module SecureHeaders
           it "sets identical values when the configs are the same" do
             Configuration.default do |config|
               config.csp = {
-                default_src: %w('self')
+                default_src: %w('self'),
+                script_src: %w('self')
               }
               config.csp_report_only = {
-                default_src: %w('self')
+                default_src: %w('self'),
+                script_src: %w('self')
               }
             end
 
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
           end
 
           it "sets different headers when the configs are different" do
             Configuration.default do |config|
               config.csp = {
-                default_src: %w('self')
+                default_src: %w('self'),
+                script_src: %w('self')
               }
-              config.csp_report_only = config.csp.merge({script_src: %w('self')})
+              config.csp_report_only = config.csp.merge({script_src: %w(foo.com)})
             end
 
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' foo.com")
           end
 
           it "allows you to opt-out of enforced CSP" do
             Configuration.default do |config|
               config.csp = SecureHeaders::OPT_OUT
               config.csp_report_only = {
-                default_src: %w('self')
-              }
-            end
-
-            hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to be_nil
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'")
-          end
-
-          it "opts-out of enforced CSP when only csp_report_only is set" do
-            expect(Kernel).to receive(:warn).once
-            Configuration.default do |config|
-              config.csp_report_only = {
-                default_src: %w('self')
-              }
-            end
-
-            hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to be_nil
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'")
-          end
-
-          it "allows you to set csp_report_only before csp" do
-            expect(Kernel).to receive(:warn).once
-            Configuration.default do |config|
-              config.csp_report_only = {
-                default_src: %w('self')
+                default_src: %w('self'),
+                script_src: %w('self')
               }
-              config.csp = config.csp_report_only.merge({script_src: %w('unsafe-inline')})
             end
 
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src 'self' 'unsafe-inline'")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'")
+            expect(hash["Content-Security-Policy"]).to be_nil
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
           end
 
           it "allows appending to the enforced policy" do
             SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :enforced)
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src 'self' anothercdn.com")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
           end
 
           it "allows appending to the report only policy" do
             SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :report_only)
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
           end
 
           it "allows appending to both policies" do
             SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :both)
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src 'self' anothercdn.com")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
           end
 
           it "allows overriding the enforced policy" do
             SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :enforced)
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src anothercdn.com")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
           end
 
           it "allows overriding the report only policy" do
             SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :report_only)
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; script-src anothercdn.com")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src anothercdn.com")
           end
 
           it "allows overriding both policies" do
             SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :both)
             hash = SecureHeaders.header_hash_for(request)
-            expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src anothercdn.com")
-            expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; script-src anothercdn.com")
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src anothercdn.com")
           end
 
           context "when inferring which config to modify" do
             it "updates the enforced header when configured" do
               Configuration.default do |config|
                 config.csp = {
-                  default_src: %w('self')
+                  default_src: %w('self'),
+                  script_src: %w('self')
                 }
               end
               SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
 
               hash = SecureHeaders.header_hash_for(request)
-              expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src 'self' anothercdn.com")
-              expect(hash['Content-Security-Policy-Report-Only']).to be_nil
+              expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+              expect(hash["Content-Security-Policy-Report-Only"]).to be_nil
             end
 
             it "updates the report only header when configured" do
               Configuration.default do |config|
                 config.csp = OPT_OUT
                 config.csp_report_only = {
-                  default_src: %w('self')
+                  default_src: %w('self'),
+                  script_src: %w('self')
                 }
               end
               SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
 
               hash = SecureHeaders.header_hash_for(request)
-              expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; script-src 'self' anothercdn.com")
-              expect(hash['Content-Security-Policy']).to be_nil
+              expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+              expect(hash["Content-Security-Policy"]).to be_nil
             end
 
             it "updates both headers if both are configured" do
               Configuration.default do |config|
                 config.csp = {
-                  default_src: %w(enforced.com)
+                  default_src: %w(enforced.com),
+                  script_src: %w('self')
                 }
                 config.csp_report_only = {
-                  default_src: %w(reportonly.com)
+                  default_src: %w(reportonly.com),
+                  script_src: %w('self')
                 }
               end
               SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
 
               hash = SecureHeaders.header_hash_for(request)
-              expect(hash['Content-Security-Policy']).to eq("default-src enforced.com; script-src enforced.com anothercdn.com")
-              expect(hash['Content-Security-Policy-Report-Only']).to eq("default-src reportonly.com; script-src reportonly.com anothercdn.com")
+              expect(hash["Content-Security-Policy"]).to eq("default-src enforced.com; script-src 'self' anothercdn.com")
+              expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src reportonly.com; script-src 'self' anothercdn.com")
             end
 
           end
@@ -520,7 +492,7 @@ module SecureHeaders
       it "validates your hsts config upon configuration" do
         expect do
           Configuration.default do |config|
-            config.hsts = 'lol'
+            config.hsts = "lol"
           end
         end.to raise_error(STSConfigError)
       end
@@ -528,7 +500,7 @@ module SecureHeaders
       it "validates your csp config upon configuration" do
         expect do
           Configuration.default do |config|
-            config.csp = { ContentSecurityPolicy::DEFAULT_SRC => '123456' }
+            config.csp = { ContentSecurityPolicy::DEFAULT_SRC => "123456" }
           end
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
@@ -536,7 +508,7 @@ module SecureHeaders
       it "raises errors for unknown directives" do
         expect do
           Configuration.default do |config|
-            config.csp = { made_up_directive: '123456' }
+            config.csp = { made_up_directive: "123456" }
           end
         end.to raise_error(ContentSecurityPolicyConfigError)
       end