tiradoe/movie-night-nuevo
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

undid nonce changes
Some checks are pending
linter / quality (push) Waiting to run
Details
tests / ci (push) Waiting to run
Details

Browse source
This commit is contained in:
Edward Tirado Jr 2025-12-14 23:02:11 -06:00
parent a0748788ee
commit 844097ecf0
3 changed files with 6 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

17
app/Http/Middleware/AddContentSecurityPolicy.php
View file

@ -15,13 +15,6 @@ class AddContentSecurityPolicy
*/ */
public function handle(Request $request, Closure $next): Response public function handle(Request $request, Closure $next): Response
{ {
// Generate a random nonce for this request
$nonce = base64_encode(random_bytes(16));
// Store nonce in request attributes so Livewire can access it
$request->attributes->set('csp-nonce', $nonce);
// Get the response
$response = $next($request); $response = $next($request);
// Build CSP header // Build CSP header
@ -31,12 +24,10 @@ class AddContentSecurityPolicy
"style-src 'self' 'unsafe-inline' http: https:; " . "style-src 'self' 'unsafe-inline' http: https:; " .
"connect-src 'self' ws: http: https:;"; "connect-src 'self' ws: http: https:;";
} else { } else {
// Strict CSP for production with nonces // Production CSP - Livewire v3 requires unsafe-eval
$scriptSrc = "'self' 'nonce-{$nonce}' https:"; $csp = "script-src 'self' 'unsafe-eval' https:; " .
$styleSrc = "'self' 'unsafe-inline' https:"; "style-src 'self' 'unsafe-inline' https:; " .
$connectSrc = "'self' https:"; "connect-src 'self' https:;";
$csp = "script-src {$scriptSrc}; style-src {$styleSrc}; connect-src {$connectSrc};";
} }
$response->headers->set('Content-Security-Policy', $csp); $response->headers->set('Content-Security-Policy', $csp);

2
resources/views/components/layouts/app.blade.php
View file

@ -6,7 +6,7 @@
<x-header/> <x-header/>
{{ $slot }} {{ $slot }}
</div> </div>
@livewireScriptConfig(['nonce' => request()->attributes->get('csp-nonce')]) @livewireScriptConfig
</body> </body>
</html> </html>

2
resources/views/components/layouts/auth.blade.php
View file

@ -3,6 +3,6 @@
<x-head/> <x-head/>
<body class="bg-blue-600"> <body class="bg-blue-600">
{{ $slot }} {{ $slot }}
@livewireScriptConfig(['nonce' => request()->attributes->get('csp-nonce')]) @livewireScripts
</body> </body>
</html> </html>