diff --git a/app/Http/Middleware/ContentSecurityPolicy.php b/app/Http/Middleware/ContentSecurityPolicy.php
index 13cf72b..145f576 100644
--- a/app/Http/Middleware/ContentSecurityPolicy.php
+++ b/app/Http/Middleware/ContentSecurityPolicy.php
@@ -33,8 +33,6 @@ class ContentSecurityPolicy
return $response;
}
- $allowUnsafeInlineStyles = $request->is('event-admin*');
-
$matomoOrigin = $this->normaliseOrigin(config('services.matomo.url'));
$scriptSources = [
"'self'",
@@ -120,11 +118,7 @@ class ContentSecurityPolicy
$styleSources[] = 'data:';
$connectSources[] = 'https:';
$fontSources[] = 'https:';
- $styleElemSources = $styleSources;
-
- if ($allowUnsafeInlineStyles) {
- $styleElemSources = array_unique(array_merge($styleElemSources, ["'unsafe-inline'"]));
- }
+ $styleElemSources = array_unique(array_merge($styleSources, ["'unsafe-inline'"]));
$directives = [
'default-src' => ["'self'"],
diff --git a/resources/js/pages/welcome.tsx b/resources/js/pages/welcome.tsx
index 367eee0..f94b93a 100644
--- a/resources/js/pages/welcome.tsx
+++ b/resources/js/pages/welcome.tsx
@@ -8,8 +8,6 @@ export default function Welcome() {
return (
<>
-
-
diff --git a/resources/views/app.blade.php b/resources/views/app.blade.php
index 35b6f67..2ba94f2 100644
--- a/resources/views/app.blade.php
+++ b/resources/views/app.blade.php
@@ -33,8 +33,6 @@
-
-
@viteReactRefresh
@vite(['resources/css/app.css', 'resources/js/app.tsx', "resources/js/pages/{$page['component']}.tsx"])
diff --git a/tests/Feature/SecurityHeadersTest.php b/tests/Feature/SecurityHeadersTest.php
index 4b8f5b4..561b99d 100644
--- a/tests/Feature/SecurityHeadersTest.php
+++ b/tests/Feature/SecurityHeadersTest.php
@@ -37,6 +37,7 @@ class SecurityHeadersTest extends TestCase
$response->assertHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
$response->assertHeader('Content-Security-Policy');
$response->assertHeaderContains('Content-Security-Policy', "style-src-elem 'self'");
+ $response->assertHeaderContains('Content-Security-Policy', "'unsafe-inline'; style-src-attr");
$response->assertHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
$response->assertCookie('XSRF-TOKEN');
@@ -48,6 +49,7 @@ class SecurityHeadersTest extends TestCase
$login->assertOk();
$login->assertHeader('Content-Security-Policy');
$login->assertHeaderContains('Content-Security-Policy', "style-src-elem 'self'");
+ $login->assertHeaderContains('Content-Security-Policy', "'unsafe-inline'; style-src-attr");
$login->assertHeader('X-Frame-Options', 'SAMEORIGIN');
$login->assertCookie('XSRF-TOKEN');
} finally {