diff --git a/app/Http/Middleware/AddContentSecurityPolicy.php b/app/Http/Middleware/AddContentSecurityPolicy.php index df4bb98..92be6a6 100644 --- a/app/Http/Middleware/AddContentSecurityPolicy.php +++ b/app/Http/Middleware/AddContentSecurityPolicy.php @@ -15,13 +15,6 @@ class AddContentSecurityPolicy */ public function handle(Request $request, Closure $next): Response { - // Generate a random nonce for this request - $nonce = base64_encode(random_bytes(16)); - - // Store nonce in request attributes so Livewire can access it - $request->attributes->set('csp-nonce', $nonce); - - // Get the response $response = $next($request); // Build CSP header @@ -31,12 +24,10 @@ class AddContentSecurityPolicy "style-src 'self' 'unsafe-inline' http: https:; " . "connect-src 'self' ws: http: https:;"; } else { - // Strict CSP for production with nonces - $scriptSrc = "'self' 'nonce-{$nonce}' https:"; - $styleSrc = "'self' 'unsafe-inline' https:"; - $connectSrc = "'self' https:"; - - $csp = "script-src {$scriptSrc}; style-src {$styleSrc}; connect-src {$connectSrc};"; + // Production CSP - Livewire v3 requires unsafe-eval + $csp = "script-src 'self' 'unsafe-eval' https:; " . + "style-src 'self' 'unsafe-inline' https:; " . + "connect-src 'self' https:;"; } $response->headers->set('Content-Security-Policy', $csp); diff --git a/resources/views/components/layouts/app.blade.php b/resources/views/components/layouts/app.blade.php index 522f35f..46b746e 100644 --- a/resources/views/components/layouts/app.blade.php +++ b/resources/views/components/layouts/app.blade.php @@ -6,7 +6,7 @@ {{ $slot }} -@livewireScriptConfig(['nonce' => request()->attributes->get('csp-nonce')]) +@livewireScriptConfig diff --git a/resources/views/components/layouts/auth.blade.php b/resources/views/components/layouts/auth.blade.php index a9e4e2f..69707fe 100644 --- a/resources/views/components/layouts/auth.blade.php +++ b/resources/views/components/layouts/auth.blade.php @@ -3,6 +3,6 @@ {{ $slot }} -@livewireScriptConfig(['nonce' => request()->attributes->get('csp-nonce')]) +@livewireScripts