161 lines
4.6 KiB
PHP
161 lines
4.6 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class StripeCSP
|
|
{
|
|
/**
|
|
* Apply a CSP that allows Stripe and PayPal assets on the purchase wizard.
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$response = $next($request);
|
|
|
|
$isLocal = app()->environment('local');
|
|
|
|
$scriptSrc = [
|
|
"'self'",
|
|
"'unsafe-inline'",
|
|
'https://js.stripe.com',
|
|
'https://js.stripe.network',
|
|
'https://m.stripe.network',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
'https://www.paypalobjects.com',
|
|
'https://*.paypalobjects.com',
|
|
];
|
|
|
|
$styleSrc = [
|
|
"'self'",
|
|
"'unsafe-inline'",
|
|
'data:',
|
|
'https:',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
'https://www.paypalobjects.com',
|
|
'https://*.paypalobjects.com',
|
|
];
|
|
|
|
$imgSrc = [
|
|
"'self'",
|
|
'data:',
|
|
'https:',
|
|
'blob:',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://q.stripe.com',
|
|
'https://r.stripe.com',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
'https://www.paypalobjects.com',
|
|
'https://*.paypalobjects.com',
|
|
];
|
|
|
|
$fontSrc = [
|
|
"'self'",
|
|
'data:',
|
|
'https:',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://www.paypalobjects.com',
|
|
'https://*.paypalobjects.com',
|
|
];
|
|
|
|
$connectSrc = [
|
|
"'self'",
|
|
'https://api.stripe.com',
|
|
'https://api.stripe.network',
|
|
'https://js.stripe.com',
|
|
'https://m.stripe.com',
|
|
'https://m.stripe.network',
|
|
'https://connect.stripe.com',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://r.stripe.com',
|
|
'https://q.stripe.com',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
'https://www.paypalobjects.com',
|
|
'https://*.paypalobjects.com',
|
|
'wss://*.stripe.network',
|
|
];
|
|
|
|
$mediaSrc = [
|
|
"'self'",
|
|
'data:',
|
|
'blob:',
|
|
'https:',
|
|
'https://js.stripe.com',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://m.stripe.network',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
'https://www.paypalobjects.com',
|
|
'https://*.paypalobjects.com',
|
|
];
|
|
|
|
$frameSrc = [
|
|
"'self'",
|
|
'https://js.stripe.com',
|
|
'https://*.stripe.com',
|
|
'https://hooks.stripe.com',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
];
|
|
|
|
$workerSrc = [
|
|
"'self'",
|
|
'blob:',
|
|
'https://js.stripe.com',
|
|
'https://*.stripe.com',
|
|
'https://*.stripe.network',
|
|
'https://m.stripe.network',
|
|
'https://www.paypal.com',
|
|
'https://*.paypal.com',
|
|
];
|
|
|
|
if ($isLocal) {
|
|
$devHost = 'http://localhost:5173';
|
|
|
|
$scriptSrc[] = $devHost;
|
|
$styleSrc[] = $devHost;
|
|
$imgSrc[] = $devHost;
|
|
$fontSrc[] = $devHost;
|
|
$connectSrc[] = $devHost;
|
|
$connectSrc[] = 'ws://localhost:5173';
|
|
$mediaSrc[] = $devHost;
|
|
$frameSrc[] = $devHost;
|
|
$workerSrc[] = $devHost;
|
|
}
|
|
|
|
$directives = [
|
|
"default-src 'self'",
|
|
'script-src ' . implode(' ', $scriptSrc),
|
|
'style-src ' . implode(' ', $styleSrc),
|
|
'img-src ' . implode(' ', $imgSrc),
|
|
'font-src ' . implode(' ', $fontSrc),
|
|
'connect-src ' . implode(' ', $connectSrc),
|
|
'media-src ' . implode(' ', $mediaSrc),
|
|
'frame-src ' . implode(' ', $frameSrc),
|
|
'worker-src ' . implode(' ', $workerSrc),
|
|
'child-src ' . implode(' ', $frameSrc),
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
];
|
|
|
|
$response->headers->set('Content-Security-Policy', implode('; ', $directives) . ';');
|
|
|
|
return $response;
|
|
}
|
|
}
|