|
@@ -21,15 +21,17 @@ class AddContentSecurityPolicyHeaders
|
|
|
|
|
|
$assetUrl = config('app.asset_url') != config('app.url') ? config('app.asset_url') : '';
|
|
|
|
|
|
- $directives['script-src'] = "script-src 'nonce-" . Vite::cspNonce() . "' " . $assetUrl . ";";
|
|
|
+ $directives['script-src'] = "script-src 'nonce-" . Vite::cspNonce() . "' " . $assetUrl . ';';
|
|
|
$directives['script-src-elem'] = "script-src-elem 'nonce-" . Vite::cspNonce() . "' " . $assetUrl . " 'strict-dynamic';";
|
|
|
- $directives['style-src'] = "style-src 'self' " . $assetUrl . " 'unsafe-inline';";
|
|
|
- $directives['connect-src'] = "connect-src 'self';";
|
|
|
- $directives['img-src'] = "img-src 'self' data: " . $assetUrl . ";";
|
|
|
- $directives['object-src'] = "object-src 'none';";
|
|
|
+ $directives['style-src'] = "style-src 'self' " . $assetUrl . " 'unsafe-inline';";
|
|
|
+ $directives['connect-src'] = "connect-src 'self';";
|
|
|
+ $directives['img-src'] = "img-src 'self' data: " . $assetUrl . ';';
|
|
|
+ $directives['object-src'] = "object-src 'none';";
|
|
|
|
|
|
$csp = implode(' ', $directives);
|
|
|
|
|
|
+ /** @disregard Undefined function */
|
|
|
+ /** @phpstan-ignore-next-line */
|
|
|
return $next($request)->withHeaders([
|
|
|
'Content-Security-Policy' => $csp,
|
|
|
]);
|