[antosubash]

Summary

• SecurityHeadersMiddleware no longer overwrites a Content-Security-Policy that a response sets. It keeps every response policy and sends the nonced app policy beside it as a second header. Browsers enforce both, so a page can tighten the policy (for example frame-ancestors 'none' on a public page) but never relax it. Before this, only a policy containing sandbox survived; any other was dropped silently.
• Behaviour change: a response that set a looser policy, relying on it being replaced, now has both policies enforced. In this repo only file_storage sets a policy, and it is a sandbox policy, so nothing here changes.
• Docs (middleware.md, module-authoring.md, file_storage.md) explain how to make a page stricter, the nonce caveat and X-Frame-Options. The CHANGELOG has a Fixed entry.

Closes #870

Verification

• No browser run: only response headers change, and ASGI tests in framework/hosting/tests/test_hosting_csp_nonce.py cover it. They check that a stricter policy is kept beside the nonced app policy, that two response policies are both kept, that a response without a policy gets one header, and that the existing sandbox and 304 cases still pass.
• Local CI: make lint (including typecheck) passes, make test-py 8,238 passed and make test-js 900 passed.
• Review: two passes with Sonnet correctness and maintainability reviewers, plus Codex on the first pass, which found no issues.
• Verification report: https://claude.ai/artifact/AB7NL8H1JBYozAc2vyrxDC

Report links are Claude Artifacts and start private. The author can share them from claude.ai/code/artifacts if reviewers need access.

Test plan

• A route that returns Content-Security-Policy: frame-ancestors 'none' sends two CSP headers, and the page can't be framed
• CI is green

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-11-07T19:56:14.385364Z	84fec6a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	84fec6a
Status:	✅  Deploy successful!
Preview URL:	https://c8a2e6f8.simple-module-python.pages.dev
Branch Preview URL:	https://fix-issue-870-response-csp.simple-module-python.pages.dev

View logs