Merge pull request #114 from kumarrishav/patch-1

Add style/script directive if nonce is true

Author: linkRace

CHANGELOG.md

@@ -1,3 +1,7 @@
+##### v1.5.2
+
+* Bugfix: Add style/script directive if nonce is true
+
 ##### v1.5.1
 
 * Bugfix: style-src nonce updates properly, speed improvement on match

lib/csp.js

@@ -19,6 +19,16 @@ module.exports = function (options) {
         name += '-report-only';
     }
 
+    if (policyRules && policyRules["default-src"]) {
+        if (styleNonce && !policyRules["style-src"]) {
+            policyRules["style-src"] = policyRules["default-src"];
+        }
+        
+        if (scriptNonce && !policyRules["script-src"]) {
+            policyRules["script-src"] = policyRules["default-src"];
+        }
+    }
+
     value = createPolicyString(policyRules);
 
     if (reportUri) {