CODEWITHSUNDEEP
laravelwebpacklaravel-mix
Seyid Takele
Seyid Takele

Reputation: 1228

Laravel CSP how to allow inline styles in Laravel Mix Webpack

I am using the spatie/laravel-csp package to set CSP headers in a Laravel application. But the inline style could not be applied and refused with the following error.

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self.' 'nonce-TjpZGox5zGathTvJDeVMfxzHaOtWMc7v' 'unsafe-inline'".

Further detail.

  1. I am using Laravel 7.
  2. /spatie/laravel-csp 2.8
  3. "laravel-mix": "^5.0.1",
  4. and inertia with Vue 2

What I have tried so far.

  1. specify webpack_nonce @ entry file (main.js) webpack documentation
  2. Using inline scripts and styles as in spatie/laravel-csp documentation

Upvotes: 0

Views: 1536

Answers (2)

Isaiah M Fisher
Isaiah M Fisher

Reputation: 151

If you are using Laravel try specifying your webpack_nonce in the index.php file.

Upvotes: 0

NIKUNJ KOTHIYA
NIKUNJ KOTHIYA

Reputation: 2165

You can also do your CSP for styles by adding style-src 'self' 'unsafe-inline';

In your manifest file add this line :

"content_security_policy": "default-src 'self' style-src 'self' 'unsafe-inline';"

This will allow you to keep using the inline style in your extension.

Note: This is not recommended way to do style tag inline to prevent attacks.

Upvotes: -1

Related Questions