public static String addCspHeadersWithNonceToResponse(HttpResponse httpResponse) {
    final String nonce = getNonce();

    List<String> cspPolicies = List.of(
      "default-src 'self'",
      "base-uri 'none'",
      "connect-src 'self' http: https:",
      "font-src 'self' data:;" +
      "img-src * data: blob:",
      "object-src 'none'",
      "script-src 'nonce-" + nonce + "'",
      "style-src 'self' 'unsafe-inline'",
      "worker-src 'none'");
    String policies = String.join("; ", cspPolicies).trim();

    List<String> cspHeaders = List.of("Content-Security-Policy", "X-Content-Security-Policy", "X-WebKit-CSP");
    cspHeaders.forEach(header -> httpResponse.setHeader(header, policies));
    return nonce;
  }
@Test
  public void addCspHeadersWithNonceToResponse_whenCalled_shouldAddNonceToCspHeaders() {
    HttpResponse httpServletResponse = mock(HttpResponse.class);

    String nonce = addCspHeadersWithNonceToResponse(httpServletResponse);

    verify(httpServletResponse).setHeader(eq("Content-Security-Policy"), contains("script-src 'nonce-" + nonce + "'"));
    verify(httpServletResponse).setHeader(eq("X-Content-Security-Policy"), contains("script-src 'nonce-" + nonce + "'"));
    verify(httpServletResponse).setHeader(eq("X-WebKit-CSP"), contains("script-src 'nonce-" + nonce + "'"));
  }