forge-joniko/ldc-boutique-cnc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CSP remove unrequired policies

Browse source
This commit is contained in:
Jérémy Munsch 2023-02-22 14:46:02 +01:00
parent 74dc29781b
commit cdd69b66d0
No known key found for this signature in database
GPG key ID: 18361AF3BFEC0FEC
1 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/Http/Middleware/SecureHeaders.php
View file

@ -32,7 +32,7 @@ class SecureHeaders
{
View::share('nonce', $nonce = \uniqid());
// * For VueJS dev tool to execute
$jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : '';
$jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
$scheme = config('app.env') === 'local' ? 'http' : 'https';
$reportUri = Route::has('cspReportUri') ?
\sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
@ -68,9 +68,8 @@ class SecureHeaders
// ! If you dont use ckeditor use this
// "style-src 'self' 'nonce-$nonce';",
// phpcs:ignore Generic.Files.LineLength.TooLong
"script-src 'self' {$jsDev} 'nonce-{$nonce}' " . \implode(' ', [
// '\'strict-dynamic\' https: blob:',
'\'strict-dynamic\' https: blob: \'unsafe-eval\'',
"script-src 'self' {$jsDev} " . \implode(' ', [
'https: blob:',
'https://www.googletagmanager.com',
'https://cdnjs.cloudflare.com',
"$scheme://www.google-analytics.com",