[CSP2] Number of CSP Header Fields

Hello,

 

I have a question about the Header Field.

I'm referring to
http://www.w3.org/TR/CSP2/#content-security-policy-header-field

 

First statement:

"A server MUST NOT send more than one HTTP header field named
Content-Security-Policy with a given resource representation."

 

According to RFC 2119 (https://www.ietf.org/rfc/rfc2119.txt) it's prohibited
to send more than one header field.

But the last statement says:

"Upon receiving an HTTP response containing at least one
Content-Security-Policy header field, the user agent MUST enforce each of
the policies contained in each such header field."

 

At least one? The first statement is really clear?

 

 

Thank you

Stefan Ossendorf