tiradoe/movie-night-nuevo
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

undid nonce changes
Some checks are pending
linter / quality (push) Waiting to run
Details
tests / ci (push) Waiting to run
Details

Browse source
This commit is contained in:
Edward Tirado Jr 2025-12-14 23:02:11 -06:00
parent a0748788ee
commit 844097ecf0
3 changed files with 6 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

17
app/Http/Middleware/AddContentSecurityPolicy.php
View file

@ -15,13 +15,6 @@ class AddContentSecurityPolicy
*/
public function handle(Request $request, Closure $next): Response
{
// Generate a random nonce for this request
$nonce = base64_encode(random_bytes(16));
// Store nonce in request attributes so Livewire can access it
$request->attributes->set('csp-nonce', $nonce);
// Get the response
$response = $next($request);
// Build CSP header
@ -31,12 +24,10 @@ class AddContentSecurityPolicy
"style-src 'self' 'unsafe-inline' http: https:; " .
"connect-src 'self' ws: http: https:;";
} else {
// Strict CSP for production with nonces
$scriptSrc = "'self' 'nonce-{$nonce}' https:";
$styleSrc = "'self' 'unsafe-inline' https:";
$connectSrc = "'self' https:";
$csp = "script-src {$scriptSrc}; style-src {$styleSrc}; connect-src {$connectSrc};";
// Production CSP - Livewire v3 requires unsafe-eval
$csp = "script-src 'self' 'unsafe-eval' https:; " .
"style-src 'self' 'unsafe-inline' https:; " .
"connect-src 'self' https:;";
}
$response->headers->set('Content-Security-Policy', $csp);

2
resources/views/components/layouts/app.blade.php
View file

@ -6,7 +6,7 @@
<x-header/>
{{ $slot }}
</div>
@livewireScriptConfig(['nonce' => request()->attributes->get('csp-nonce')])
@livewireScriptConfig
</body>
</html>

2
resources/views/components/layouts/auth.blade.php
View file

@ -3,6 +3,6 @@
<x-head/>
<body class="bg-blue-600">
{{ $slot }}
@livewireScriptConfig(['nonce' => request()->attributes->get('csp-nonce')])
@livewireScripts
</body>
</html>