MC-30971: CSP policies must be defined in a single header

Author: Oleksandr Gorkun

dev/tests/integration/testsuite/Magento/Csp/Model/Policy/Renderer/SimplePolicyHeaderRendererTest.php

@@ -53,13 +53,7 @@ public function testRenderRestrictMode(): void
 
         $this->assertNotEmpty($header = $this->response->getHeader('Content-Security-Policy'));
         $this->assertEmpty($this->response->getHeader('Content-Security-Policy-Report-Only'));
-        $contentSecurityPolicyContent = [];
-        if ($header instanceof \ArrayIterator) {
-            foreach ($header as $item) {
-                $contentSecurityPolicyContent[] = $item->getFieldValue();
-            }
-        }
-        $this->assertEquals(['default-src https://magento.com \'self\';'], $contentSecurityPolicyContent);
+        $this->assertEquals('default-src https://magento.com \'self\';', $header->getFieldValue());
     }
 
     /**
@@ -79,15 +73,9 @@ public function testRenderRestrictWithReportingMode(): void
 
         $this->assertNotEmpty($header = $this->response->getHeader('Content-Security-Policy'));
         $this->assertEmpty($this->response->getHeader('Content-Security-Policy-Report-Only'));
-        $contentSecurityPolicyContent = [];
-        if ($header instanceof \ArrayIterator) {
-            foreach ($header as $item) {
-                $contentSecurityPolicyContent[] = $item->getFieldValue();
-            }
-        }
         $this->assertEquals(
-            ['default-src https://magento.com \'self\'; report-uri /csp-reports/; report-to report-endpoint;'],
-            $contentSecurityPolicyContent
+            'default-src https://magento.com \'self\'; report-uri /csp-reports/; report-to report-endpoint;',
+            $header->getFieldValue()
         );
         $this->assertNotEmpty($reportToHeader = $this->response->getHeader('Report-To'));
         $this->assertNotEmpty($reportData = json_decode("[{$reportToHeader->getFieldValue()}]", true));

lib/internal/Magento/Framework/HTTP/PhpEnvironment/Response.php

@@ -211,7 +211,6 @@ public function sendHeaders()
             header($header->toString(), false);
         }
 
-        $this->headersSent = true;
         return $this;
     }
 }