Update 15-content-security-policy.mdx

Ensures the CSP header is still set on the response.

Author: timneutkens

docs/02-app/01-building-your-application/07-configuring/15-content-security-policy.mdx

@@ -54,20 +54,31 @@ export function middleware(request: NextRequest){
  block-all-mixed-content;
  upgrade-insecure-requests;
 `
+// Replace newline characters and spaces
+const contentSecurityPolicyHeaderValue =cspHeader
+ .replace(/\s{2,}/g, '')
+ .trim()
 
 const requestHeaders =newHeaders(request.headers)
 requestHeaders.set('x-nonce', nonce)
+
 requestHeaders.set(
 'Content-Security-Policy',
-// Replace newline characters and spaces
-cspHeader.replace(/\s{2,}/g, '').trim()
+contentSecurityPolicyHeaderValue
  )
 
-returnNextResponse.next({
+const response =NextResponse.next({
+ headers: requestHeaders,
  request:{
  headers: requestHeaders,
  },
  })
+response.headers.set(
+'Content-Security-Policy',
+contentSecurityPolicyHeaderValue
+ )
+
+returnresponse
 }
 ```
 
@@ -89,21 +100,30 @@ export function middleware(request){
  block-all-mixed-content;
  upgrade-insecure-requests;
 `
+// Replace newline characters and spaces
+constcontentSecurityPolicyHeaderValue= cspHeader
+ .replace(/\s{2,}/g, '')
+ .trim()
 
 constrequestHeaders=newHeaders(request.headers)
 requestHeaders.set('x-nonce', nonce)
 requestHeaders.set(
 'Content-Security-Policy',
-// Replace newline characters and spaces
-cspHeader.replace(/\s{2,}/g, '').trim()
+ contentSecurityPolicyHeaderValue
  )
 
-returnNextResponse.next({
+constresponse=NextResponse.next({
  headers: requestHeaders,
  request:{
  headers: requestHeaders,
  },
  })
+response.headers.set(
+'Content-Security-Policy',
+ contentSecurityPolicyHeaderValue
+ )
+
+return response
 }
 ```