fix: update middlewares and front-office routes

app/Http/Middleware/RedirectIfAuthenticated.php

@@ -29,7 +29,7 @@ class RedirectIfAuthenticated
                         return \redirect()->route('fo.homepage');
                     case 'backend':
                         if (!$request->routeIs('bo.*')) {
-                            continue;
+                            continue 2;
                         }
                         return \redirect()->route('bo.dashboard');
                     default:

app/Http/Middleware/SecureHeaders.php

@@ -11,92 +11,72 @@ use Symfony\Component\HttpFoundation\Response;
 
 class SecureHeaders
 {
-    /**
-     * Enumerate headers which you do not want in your application's responses.
-     * Great starting point would be to go check out @Scott_Helme's:
-     * https://securityheaders.com/
-     *
-     * @var array
-     */
     private $unwantedHeaderList = [
         'X-Powered-By',
         'Server',
     ];
 
-    /**
-     * Handle an incoming request.
-     *
-     * @param  \Illuminate\Http\Request                                                         $request
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
-     * @return \Symfony\Component\HttpFoundation\Response
-     * @phpcs:disable Squiz.Commenting.FunctionComment.IncorrectTypeHint
-     */
     public function handle(Request $request, Closure $next): Response
     {
-        // phpcs:enable
         // * For Vite DEV
-        $host = \parse_url(\config('app.url'), \PHP_URL_HOST);
+        $host = \parse_url((string) \config('app.url'), \PHP_URL_HOST);
+
+        $viteDevOrigin = config('app.debug') && \is_string($host) && $host !== '' ? "https://{$host}:4443" : null;
+        $viteDevSocket = config('app.debug') && \is_string($host) && $host !== '' ? "wss://{$host}:4443" : null;
+
         View::share('nonce', $nonce = Vite::useCspNonce());
+
         // * For VueJS dev tool to execute
         $jsDev     = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
         $scheme    = config('app.env') === 'local' ? 'http' : 'https';
-        $reportUri = Route::has('cspReportUri') ?
+        $reportUri = Route::has('cspReportUri') ? \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
-            \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
+
         $this->removeUnwantedHeaders($this->unwantedHeaderList);
         $response = $next($request);
+
         $response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
         $response->headers->set('X-Content-Type-Options', 'nosniff');
         $response->headers->set('X-XSS-Protection', '1; mode=block');
         $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
         $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
+
+        // Utilisation de array_filter pour ne pas inclure les valeurs null en production
         $cspPolicies = [
             "default-src 'none';",
             "manifest-src 'self';",
-            // * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html
+            "connect-src 'self' blob: " . implode(' ', array_filter([
-            "connect-src 'self' blob: " . implode(' ', [
+                $viteDevSocket,
-                // * VITE DEV
+                $viteDevOrigin,
-                config('app.debug') ? "wss://{$host}:4443" : '',
-                config('app.debug') ? "https://{$host}:4443" : '',
                 'https://yl.s-web.fr'
-            ]) . ';',
+            ])) . ';',
-            "img-src 'self' data: blob: " . implode(' ', [
+            "img-src 'self' data: blob: " . implode(' ', array_filter([
-                // * VITE DEV
+                $viteDevOrigin,
-                config('app.debug') ? "https://{$host}:4443" : '',
+            ])) . ';',
-            ]) . ';',
+            "object-src 'self';",
-            "object-src 'self' " . implode(' ', []) . ';',
             "frame-src 'self' " . implode(' ', [
                 'https://www.google.com/recaptcha/',
                 'https://recaptcha.google.com/recaptcha/',
                 'https://www.google.com/maps/'
             ]) . ';',
-            "font-src 'self' data: " . \implode(' ', [
+            "font-src 'self' data: " . implode(' ', array_filter([
-                // * VITE DEV
+                $viteDevOrigin,
-                config('app.debug') ? "https://{$host}:4443" : '',
+                'https://fonts.gstatic.com' // <-- Point-virgule retiré ici
-                'https://fonts.gstatic.com;'
+            ])) . ';',
-            ]) . ';',
+            "style-src 'self' 'unsafe-inline' " . implode(' ', array_filter([
-            // ! Using CKEditor will must have unsafe-inline style
-            // phpcs:ignore Generic.Files.LineLength.TooLong
-            "style-src 'self' 'unsafe-inline' " . \implode(' ', [
                 'https://cdnjs.cloudflare.com',
-                // * File Manager
                 'https://fonts.googleapis.com',
                 'https://cdn.jsdelivr.net',
                 'https://use.fontawesome.com',
-                'https://fonts.googleapis.com',
+                $viteDevOrigin,
-                // * VITE DEV
+            ])) . ';',
-                config('app.debug') ? "https://{$host}:4443" : '',
+            "script-src 'self' {$jsDev} " . implode(' ', array_filter([
-            ]) . ';',
+                'https:',
-            // ! If you dont use ckeditor use this
+                'blob:',
-            // "style-src 'self' 'nonce-$nonce';",
-            // phpcs:ignore Generic.Files.LineLength.TooLong
-            "script-src 'self' {$jsDev} " . \implode(' ', [
-                'https:  blob:',
                 'https://www.googletagmanager.com',
                 'https://cdnjs.cloudflare.com',
                 "$scheme://www.google-analytics.com",
-                // * VITE DEV
+                $viteDevOrigin,
-                config('app.debug') ? "https://{$host}:4443" : '',
+            ])) . ';'
-            ]) . ';'
         ];
 
         $response->headers->set(
@@ -104,15 +84,10 @@ class SecureHeaders
             implode(' ', $cspPolicies) . $reportUri
         );
         $response->headers->set('Feature-Policy', 'fullscreen \'self\';');
+
         return $response;
     }
 
-    /**
-     * Remove unwanted headers
-     *
-     * @param array $headerList
-     * @return void
-     */
     private function removeUnwantedHeaders(array $headerList): void
     {
         foreach ($headerList as $header) {

routes/web-fo.php

@@ -14,6 +14,7 @@ Route::middleware(['throttle:credentials'])->name('fo.')->group(function () {
     // * Dev route only
     if (app()->environment() === 'local') {
         Route::view('/bs-demo', 'back::pages.bs-demo')->name('bs-demo');
+                Route::view('/bs-demo-front', 'theme::pages.bs-demo')->name('bs-demo-front');
     }
 
     // * Pages début et fin de jeu