forge-joniko/ldc-com-app-bo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'develop' into trunk

Browse source
This commit is contained in:
Vincent BRIDIER 2025-06-11 11:15:22 +02:00
commit 5f372c71cd
No known key found for this signature in database
GPG key ID: 8571BFA20420D512
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
app/Http/Middleware/SecureHeaders.php
View file

@ -6,6 +6,7 @@ use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\View;
use Illuminate\Support\Facades\Vite;
class SecureHeaders
{
@ -30,10 +31,9 @@ class SecureHeaders
*/
public function handle(Request $request, Closure $next): \Symfony\Component\HttpFoundation\Response
{
View::share('nonce', $nonce = \uniqid());
View::share('nonce', $nonce = Vite::useCspNonce());
// * For VueJS dev tool to execute
$jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
$scheme = config('app.env') === 'local' ? 'http' : 'https';
$reportUri = Route::has('cspReportUri') ?
\sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
$this->removeUnwantedHeaders($this->unwantedHeaderList);
@ -49,19 +49,18 @@ class SecureHeaders
// * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html
"connect-src 'self' blob:;",
"img-src * data: blob:;",
"object-src 'self' " . implode(' ', []) . ';',
'frame-src ' . implode(' ', []) . ';',
"font-src 'self' data: ;",
// ! Using CKEditor will must have unsafe-inline style
// phpcs:ignore Generic.Files.LineLength.TooLong
"style-src 'self' 'unsafe-inline' " . \implode(' ', [
// * File Manager
'https://cdn.jsdelivr.net',
'https://use.fontawesome.com',
'https://fonts.googleapis.com'
'https://fonts.googleapis.com',
]) . ';',
// ! If you dont use ckeditor use this
// "style-src 'self' 'nonce-$nonce';",
// phpcs:ignore Generic.Files.LineLength.TooLong
"script-src 'self' {$jsDev} " . \implode(' ', [
'https: blob:',
]) . ';'
@ -76,12 +75,12 @@ class SecureHeaders
}
/**
* Remove unwanted headers
* Remove unwanted headers.
*
* @param array $headerList
* @return void
*/
private function removeUnwantedHeaders(array $headerList)
private function removeUnwantedHeaders(array $headerList): void
{
foreach ($headerList as $header) {
header_remove($header);