Breeze cache breaks(removes) csp header

Did you try with .htaccess ?

well, strict csp headers aren’t a good idea in wordpress backend. So best place is in the template header.

Respecting existing headers seems like a best practice to me, also very little performance gain to get there.

Please share the response of header with Breeze and without Breeze.

Breeze on:

HTTP/1.1 200 OK =>
Date => Mon, 04 Sep 2023 11:30:21 GMT
Server => Apache
Cache-Provider => CLOUDWAYS-CACHE-DE
Content-Encoding => gzip
Vary => Accept-Encoding,User-Agent
Strict-Transport-Security => max-age=31536000; includeSubdomains; preload
X-Frame-Options => SAMEORIGIN
Upgrade => h2c
Connection => Upgrade, close
Last-Modified => Mon, 04 Sep 2023 11:28:25 GMT
Content-Length => 4798
Cache-Control => max-age=3600
Expires => Mon, 04 Sep 2023 12:30:21 GMT
X-Clacks-Overhead => GNU Terry Pratchett
Access-Control-Allow-Methods => GET,PUT,POST,DELETE
X-XSS-Protection => 1; mode=block
X-Content-Type-Options => nosniff
Referrer-Policy => strict-origin
Access-Control-Allow-Origin => null
Access-Control-Allow-Headers => Content-Type, Authorization
Cross-Origin-Embedder-Policy => unsafe-none
Cross-Origin-Opener-Policy => same-origin
Cross-Origin-Resource-Policy => cross-origin
Permissions-Policy => accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=, display-capture=(self), document-domain=(self), encrypted-media=(self), fullscreen=, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self)
Content-Type => text/html; charset=utf-8

Breeze off:

HTTP/1.1 200 OK =>
Date => Mon, 04 Sep 2023 11:31:36 GMT
Server => Apache
Link => ; rel=shortlink
Content-Security-Policy => base-uri 'self';connect-src 'self';default-src 'self';frame-ancestors 'self';frame-src 'self';img-src data: 'self' https://i.gr-assets.com/images/S/compressed.photo.goodreads.com/books/ https://pxscdn.com;form-action 'self';font-src 'self';media-src 'self';object-src 'none';script-src 'strict-dynamic';style-src 'self';
Strict-Transport-Security => max-age=31536000; includeSubdomains; preload
X-Frame-Options => SAMEORIGIN
Vary => User-Agent,Accept-Encoding
Upgrade => h2c
Connection => Upgrade, close
Cache-Control => max-age=3600
Expires => Mon, 04 Sep 2023 12:31:36 GMT
X-Clacks-Overhead => GNU Terry Pratchett
Access-Control-Allow-Methods => GET,PUT,POST,DELETE
X-XSS-Protection => 1; mode=block
X-Content-Type-Options => nosniff
Referrer-Policy => strict-origin
Access-Control-Allow-Origin => null
Access-Control-Allow-Headers => Content-Type, Authorization
Cross-Origin-Embedder-Policy => unsafe-none
Cross-Origin-Opener-Policy => same-origin
Cross-Origin-Resource-Policy => cross-origin
Permissions-Policy => accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=, display-capture=(self), document-domain=(self), encrypted-media=(self), fullscreen=, geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self)
Content-Type => text/html; charset=UTF-8

Thanks for highlight the point. We will definitely look into it and provide the solution in our upcoming releases.

The issue has been fixed in 2.0.32.