Engineering
4 min
A second Content-Security-Policy header is not a stronger one
Two CSP headers do not override each other. The browser enforces both, your new allowed origin never takes effect, and nothing in the response looks wrong.
27 Jul 2026