Hi i tried following the guide for content security policy and the middleware example without nonces doesnt work.

I tested the app by importing a google font script using the Script tag but it didnt throw an error.

If i use the next.js config code example (instead of putting the CSP in the middleware its done in next.js config) it works.

Im confused why its not working or am i missing something?