CSP header filter may not play well with others

[GaryJones]

This method is a filter on wp_headers action:

pwa-wp/wp-includes/class-wp-https-ui.php

Lines 343 to 346 in 330c76b

	public function upgrade_insecure_requests( $headers ) {
	$headers['Content-Security-Policy'] = 'upgrade-insecure-requests';
	return $headers;
	}

If there is already some code that filters wp_headers to add a value for Content-Security-Policy, then this value wipes that out without any consideration for what may already be there.

Could the method be a bit more subtle and check for the presence of a Content-Security-Policy, and append upgrade-insecure-requests if it doesn't already exist / amend the value if there is a value that would conflict with that?

[westonruter]

Yes, that's a great point.

[pooja-muchandikar]

QA Passed ✅ the changes are reflecting as expected.

Before:

--

After: