From f0f1458a0de15a965edfbbd0be1857e8e8d6d9a5 Mon Sep 17 00:00:00 2001
From: Alexis Gousseau <alexis.gousseau@ldc.fr>
Date: Wed, 11 Jun 2025 11:11:30 +0200
Subject: [PATCH] fix: :lock: resolve csp errors #31

---
 app/Http/Middleware/SecureHeaders.php | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php
index 61ab557..9681069 100644
--- a/app/Http/Middleware/SecureHeaders.php
+++ b/app/Http/Middleware/SecureHeaders.php
@@ -6,6 +6,7 @@ use Closure;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\View;
+use Illuminate\Support\Facades\Vite;
 
 class SecureHeaders
 {
@@ -30,10 +31,9 @@ class SecureHeaders
      */
     public function handle(Request $request, Closure $next): \Symfony\Component\HttpFoundation\Response
     {
-        View::share('nonce', $nonce = \uniqid());
+        View::share('nonce', $nonce = Vite::useCspNonce());
         // * For VueJS dev tool to execute
         $jsDev     = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
-        $scheme    = config('app.env') === 'local' ? 'http' : 'https';
         $reportUri = Route::has('cspReportUri') ?
             \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
         $this->removeUnwantedHeaders($this->unwantedHeaderList);
@@ -49,19 +49,18 @@ class SecureHeaders
             // * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html
             "connect-src 'self' blob:;",
             "img-src * data: blob:;",
+            "object-src 'self' " . implode(' ', []) . ';',
             'frame-src ' . implode(' ', []) . ';',
             "font-src 'self' data: ;",
             // ! Using CKEditor will must have unsafe-inline style
-            // phpcs:ignore Generic.Files.LineLength.TooLong
             "style-src 'self' 'unsafe-inline' " . \implode(' ', [
                 // * File Manager
                 'https://cdn.jsdelivr.net',
                 'https://use.fontawesome.com',
-                'https://fonts.googleapis.com'
+                'https://fonts.googleapis.com',
             ]) . ';',
             // ! If you dont use ckeditor use this
             // "style-src 'self' 'nonce-$nonce';",
-            // phpcs:ignore Generic.Files.LineLength.TooLong
             "script-src 'self' {$jsDev} " . \implode(' ', [
                 'https:  blob:',
             ]) . ';'
@@ -76,12 +75,12 @@ class SecureHeaders
     }
 
     /**
-     * Remove unwanted headers
+     * Remove unwanted headers.
      *
      * @param array $headerList
      * @return void
      */
-    private function removeUnwantedHeaders(array $headerList)
+    private function removeUnwantedHeaders(array $headerList): void
     {
         foreach ($headerList as $header) {
             header_remove($header);