diff --git a/app/Http/Middleware/ContentSecurityPolicy.php b/app/Http/Middleware/ContentSecurityPolicy.php index 13cf72b..145f576 100644 --- a/app/Http/Middleware/ContentSecurityPolicy.php +++ b/app/Http/Middleware/ContentSecurityPolicy.php @@ -33,8 +33,6 @@ class ContentSecurityPolicy return $response; } - $allowUnsafeInlineStyles = $request->is('event-admin*'); - $matomoOrigin = $this->normaliseOrigin(config('services.matomo.url')); $scriptSources = [ "'self'", @@ -120,11 +118,7 @@ class ContentSecurityPolicy $styleSources[] = 'data:'; $connectSources[] = 'https:'; $fontSources[] = 'https:'; - $styleElemSources = $styleSources; - - if ($allowUnsafeInlineStyles) { - $styleElemSources = array_unique(array_merge($styleElemSources, ["'unsafe-inline'"])); - } + $styleElemSources = array_unique(array_merge($styleSources, ["'unsafe-inline'"])); $directives = [ 'default-src' => ["'self'"], diff --git a/resources/js/pages/welcome.tsx b/resources/js/pages/welcome.tsx index 367eee0..f94b93a 100644 --- a/resources/js/pages/welcome.tsx +++ b/resources/js/pages/welcome.tsx @@ -8,8 +8,6 @@ export default function Welcome() { return ( <> - -
diff --git a/resources/views/app.blade.php b/resources/views/app.blade.php index 35b6f67..2ba94f2 100644 --- a/resources/views/app.blade.php +++ b/resources/views/app.blade.php @@ -33,8 +33,6 @@ - - @viteReactRefresh @vite(['resources/css/app.css', 'resources/js/app.tsx', "resources/js/pages/{$page['component']}.tsx"]) diff --git a/tests/Feature/SecurityHeadersTest.php b/tests/Feature/SecurityHeadersTest.php index 4b8f5b4..561b99d 100644 --- a/tests/Feature/SecurityHeadersTest.php +++ b/tests/Feature/SecurityHeadersTest.php @@ -37,6 +37,7 @@ class SecurityHeadersTest extends TestCase $response->assertHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()'); $response->assertHeader('Content-Security-Policy'); $response->assertHeaderContains('Content-Security-Policy', "style-src-elem 'self'"); + $response->assertHeaderContains('Content-Security-Policy', "'unsafe-inline'; style-src-attr"); $response->assertHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains'); $response->assertCookie('XSRF-TOKEN'); @@ -48,6 +49,7 @@ class SecurityHeadersTest extends TestCase $login->assertOk(); $login->assertHeader('Content-Security-Policy'); $login->assertHeaderContains('Content-Security-Policy', "style-src-elem 'self'"); + $login->assertHeaderContains('Content-Security-Policy', "'unsafe-inline'; style-src-attr"); $login->assertHeader('X-Frame-Options', 'SAMEORIGIN'); $login->assertCookie('XSRF-TOKEN'); } finally {