This is a hack.

I'm not sure why, but the direct hash comparison with == would fail for arrays that were identical. Calling to_s reliably returns the right value.

Author: oreoshake

lib/secure_headers/headers/content_security_policy.rb

@@ -181,7 +181,7 @@ def validate_config!(config)
       # because google.com is already in the config.
       def idempotent_additions?(config, additions)
         return false if config == OPT_OUT
-        config == combine_policies(config, additions)
+        config.to_s == combine_policies(config, additions).to_s
       end
 
       # Public: combine the values from two different configs.