Generate nonce value for CSP header

[barryvanveen]

Config

The CSP header allows for nonce-values on the style-src and script-src directives. Both these directives have a new configuration option:

'add-generated-nonce' => true,

This option will generate a unique and secure nonce value for that request and add it to the nonces of that directive.

Usage

The generated nonce can be used to "whitelist" unsafe (i.e. inline and eval) styles and scripts.

Retrieve the nonce for this request:

$nonce = SecureHeaders::nonce();

Set the nonce-attribute on the script or style tag:

<style type="text/css" nonce="{{$nonce}}">
  // ...
</style>
<script type="text/javascript" nonce="{{$nonce}}">
  // ....
</script>

[barryvanveen]

Hi @bepsvpt,

This PR is for the enhancement I mentioned in https://github.com/BePsvPT/csp-builder/issues/1. Please let me know if I can help out in any way!

Regards,

Barry

[bepsvpt]

@barryvanveen thanks a lot!

[barryvanveen]

Hi @bepsvpt,

Can you tag a new release so we can start working with nonces? :)

[bepsvpt]

@barryvanveen sorry for not releasing a new version so long. I had tagged a new version. :)

[barryvanveen]

Not a problem at all, thank you!