content security policy header will lose When status code is 304

[Zuckjet]

Versions

• nuxt: v2.14.7
• node: v12.16.3

Reproduction

Additional Details

Steps to reproduce

What is Expected?

What is actually happening?

I have a website built with nuxt.js, when I first visit, it has the correct csp header which I set in nuxt.config.js. When I visit this website again, it will lose csp header. And I found that when status code is 304, csp header will lose.

[Zuckjet]

@pi0 @danielroe Would you please have a look on this issue ? Do you think it is a bug when http status code is 304, the CSP header will lose, if not, is there a configuration can make CSP header work as expected, if it is bug, do you have a plan to publish a patch ? Since this can cause security problem because of the miss of CSP header. Thanks

[pi0]

This should be fixed in v2.14.8. Please reopen if not.

[Zuckjet]

This should be fixed in v2.14.8. Please reopen if not.

Thanks. I have confirmed it was solved from v2.14.8