Replace csp_meta_tag with `secure_headers` nonce

diff --git a/app/views/layouts/_head.html.erb b/app/views/layouts/_head.html.erb
index 0ee5bf9c0f5c56ae7a3f4bf70eaf166fe05cfda1..34046bcab85ecac58481bfb6d0dcaf07911697b6 100644 (file)
--- a/app/views/layouts/_head.html.erb
+++ b/app/views/layouts/_head.html.erb
@@ -11,6 +11,6 @@
   <%= yield :head %>
   <%= yield :auto_discovery_link_tag %>
   <%= csrf_meta_tag %>
   <%= yield :head %>
   <%= yield :auto_discovery_link_tag %>
   <%= csrf_meta_tag %>

-  <%= csp_meta_tag %>
+  <meta name="csp-nonce" content="<%= content_security_policy_style_nonce %>" />

   <title><%= "#{@title} | " if @title %><%= t "layouts.project_name.title" %></title>
 <% end %>
   <title><%= "#{@title} | " if @title %><%= t "layouts.project_name.title" %></title>
 <% end %>