diff --git a/lib/secure_headers/view_helper.rb b/lib/secure_headers/view_helper.rb
index 7ed57311..d1ad8c60 100644
--- a/lib/secure_headers/view_helper.rb
+++ b/lib/secure_headers/view_helper.rb
@@ -65,8 +65,11 @@ def nonced_stylesheet_pack_tag(*args, &block)
# Public: use the content security policy nonce for this request directly.
# Instructs secure_headers to append a nonce to style/script-src directives.
#
+ # type - (optional) The type of nonce to generate (:script or :style).
+ # Defaults to :script to match Rails' content_security_policy_nonce behavior.
+ #
# Returns a non-html-safe nonce value.
- def _content_security_policy_nonce(type)
+ def _content_security_policy_nonce(type = :script)
case type
when :script
SecureHeaders.content_security_policy_script_nonce(@_request)
diff --git a/spec/lib/secure_headers/view_helpers_spec.rb b/spec/lib/secure_headers/view_helpers_spec.rb
index 2a7f56ed..210ea04c 100644
--- a/spec/lib/secure_headers/view_helpers_spec.rb
+++ b/spec/lib/secure_headers/view_helpers_spec.rb
@@ -188,5 +188,60 @@ module SecureHeaders
expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).not_to match(/rails-nonce/)
end
end
+
+ it "supports calling content_security_policy_nonce without parameters (Rails compatibility)" do
+ allow(SecureRandom).to receive(:base64).and_return("xyz789")
+
+ # Create a test class that simulates Rails-compatible usage
+ # where content_security_policy_nonce is called without any parameters
+ test_class = Class.new(Message) do
+ def self.template
+ <<-TEMPLATE
+
+TEMPLATE
+ end
+ end
+
+ message = test_class.new(request)
+ result = message.result
+
+ # The nonce should be included in the rendered output
+ expect(result).to include('nonce="xyz789"')
+
+ # Call middleware to generate headers
+ _, env = middleware.call request.env
+
+ # The nonce should be added to script-src in the CSP header (default behavior)
+ expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/script-src[^;]*'nonce-xyz789'/)
+ end
+
+ it "supports calling content_security_policy_nonce with :style parameter" do
+ allow(SecureRandom).to receive(:base64).and_return("style123")
+
+ # Create a test class that calls content_security_policy_nonce with :style
+ test_class = Class.new(Message) do
+ def self.template
+ <<-TEMPLATE
+
+TEMPLATE
+ end
+ end
+
+ message = test_class.new(request)
+ result = message.result
+
+ # The nonce should be included in the rendered output
+ expect(result).to include('nonce="style123"')
+
+ # Call middleware to generate headers
+ _, env = middleware.call request.env
+
+ # The nonce should be added to style-src in the CSP header
+ expect(env[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/style-src[^;]*'nonce-style123'/)
+ end
end
end