Geoff Appleby
--- a/core/tests/Drupal/Tests/Core/EventSubscriber/FinishResponseSubscriberTest.php
+++ b/core/tests/Drupal/Tests/Core/EventSubscriber/FinishResponseSubscriberTest.php
+
+    $request = $this->createMock(Request::class);
+    $response = $this->createMock(Response::class);
+    $response->headers = new ResponseHeaderBag();
+    $event = new ResponseEvent($this->kernel, $request, HttpKernelInterface::MAIN_REQUEST, $response);
+
+    $finishSubscriber->onRespond($event);
+
+    $this->assertEquals(["default-src 'self'"], $response->headers->all('Content-Security-Policy-Report-Only'));
+    $this->assertEquals(["script-src * 'unsafe-inline'"], $response->headers->all('Content-Security-Policy'));
+  }
+
+  /**
+   * Data Provider for testing conversion of X-Frame-Options to CSP header.
+   *
+   * @todo Remove in Drupal 11.0.0. See https://www.drupal.org/project/drupal/issues/2513356
--- a/core/tests/Drupal/Tests/Core/EventSubscriber/FinishResponseSubscriberTest.php
+++ b/core/tests/Drupal/Tests/Core/EventSubscriber/FinishResponseSubscriberTest.php
+      ],
+      'deny' => [
+        'DENY',
+        "script-src * 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'",
+      ],
+      'domain' => [
+        'ALLOW-FROM https://example.com',
+        "script-src * 'unsafe-inline'; object-src 'none'; frame-ancestors https://example.com",
+      ],
+    ];
+  }
+
+  /**
+   * X-Frame-Options should be converted to a CSP header.
+   *
+   * @todo Remove in Drupal 11.0.0. See https://www.drupal.org/project/drupal/issues/2513356
--- a/core/core.services.yml
+++ b/core/core.services.yml
    debug: false
  factory.keyvalue:
    default: keyvalue.database
+  http.response.content_security_policy: