starred/newznab-tmux
1
0
Fork 0
mirror of https://github.com/NNTmux/newznab-tmux.git synced 2026-08-29 01:08:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add horizon nonce

Browse Source
This commit is contained in:
DariusIII
2026-08-04 12:49:21 +02:00
parent fbf036598a
commit 1b9455bdaa
2 changed files with 67 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Middleware/ContentSecurityPolicy.php
+5 -14
View File
@@ -7,6 +7,7 @@ namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Vite;
use Laravel\Horizon\Horizon;
use Symfony\Component\HttpFoundation\Response;
class ContentSecurityPolicy
@@ -19,20 +20,10 @@ class ContentSecurityPolicy
// Tell Vite to add the CSP nonce to generated script/style tags
$nonce = function_exists('csp_nonce') ? csp_nonce() : base64_encode(random_bytes(16));
Vite::useCspNonce($nonce);
Horizon::cspNonce($nonce);
$response = $next($request);
// Skip strict CSP for Horizon dashboard (admin-only). Horizon uses inline
// scripts and does not support nonces; it is already protected by auth/role.
$horizonPath = trim(config('horizon.path', 'horizon'), '/');
if ($horizonPath !== '' && $request->is($horizonPath, $horizonPath.'/*')) {
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
return $response;
}
// Check if Turnstile is enabled
$turnstileEnabled = config('captcha.provider') === 'turnstile'
&& config('captcha.turnstile.enabled') === true;
@@ -63,9 +54,9 @@ class ContentSecurityPolicy
"script-src 'self' 'nonce-{$nonce}' 'unsafe-eval' 'strict-dynamic' https://challenges.cloudflare.com https://cdn.tiny.cloud https://cdn.jsdelivr.net/ https://static.cloudflareinsights.com/ https://cdnjs.cloudflare.com/ https://unpkg.com/ https://cdn.tailwindcss.com/ https://code.jquery.com https://apis.google.com https://www.google.com https://www.gstatic.com https://ajax.cloudflare.com blob:",
"script-src-elem 'self' 'nonce-{$nonce}' https://challenges.cloudflare.com https://cdn.tiny.cloud https://cdn.jsdelivr.net/ https://static.cloudflareinsights.com/ https://cdnjs.cloudflare.com/ https://unpkg.com/ https://cdn.tailwindcss.com/ https://code.jquery.com https://apis.google.com https://www.google.com https://www.gstatic.com https://ajax.cloudflare.com",
"script-src-attr 'none'",
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net/ https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud",
"style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net/ https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud",
"font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud data:",
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.bunny.net https://cdn.jsdelivr.net/ https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud",
"style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.bunny.net https://cdn.jsdelivr.net/ https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud",
"font-src 'self' https://fonts.gstatic.com https://fonts.bunny.net https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud data:",
"img-src 'self' data: https: blob:",
"connect-src 'self' https://www.google.com https://cdn.tiny.cloud https://sp.tinymce.com",
"frame-src 'self' https://www.google.com https://www.gstatic.com https://challenges.cloudflare.com https://cdn.tiny.cloud data: blob:",