Merge pull request #142 from nckrtl/patch-1

ashleyhindle · web-flow · commit 4bd1692c064b · 2025-09-18T08:33:27.000+01:00
Add support for Vite CSP nonce
diff --git a/src/Services/BrowserLogger.php b/src/Services/BrowserLogger.php
@@ -5,6 +5,8 @@
 namespace Laravel\Boost\Services;
 
 use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Vite;
+use Illuminate\View\ComponentAttributeBag;
 
 class BrowserLogger
 {
@@ -14,8 +16,16 @@ public static function getScript(): string
             ? route('boost.browser-logs')
             : '/_boost/browser-logs';
 
+        $attributes = new ComponentAttributeBag([
+            'id' => 'browser-logger-active',
+        ]);
+
+        if ($nonce = Vite::cspNonce()) {
+            $attributes = $attributes->merge(['nonce' => $nonce]);
+        }
+
         return <<<HTML
-<script id="browser-logger-active">
+<script {$attributes->toHtml()}>
 (function() {
     const ENDPOINT = '{$endpoint}';
     const logQueue = [];
diff --git a/tests/Feature/Middleware/InjectBoostTest.php b/tests/Feature/Middleware/InjectBoostTest.php
@@ -5,6 +5,8 @@
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Vite;
+use Illuminate\Testing\TestResponse;
 use Laravel\Boost\Middleware\InjectBoost;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\JsonResponse;
@@ -89,3 +91,30 @@ function createMiddlewareResponse($response): SymfonyResponse
     'with head and body tags' => '<html><head><title>Test</title></head><body></body></html>',
     'without head/body tags' => '<html>Test</html>',
 ]);
+
+it('handles CSP nonce attribute correctly', function ($nonce, $assertions) {
+    if ($nonce) {
+        Vite::useCspNonce($nonce);
+    }
+
+    Route::get('injection-test', fn () => view('test::injection-test'))
+        ->middleware(InjectBoost::class);
+
+    $response = $this->get('injection-test')->assertViewIs('test::injection-test');
+
+    $assertions($response);
+})->with([
+    'with CSP nonce configured' => [
+        'test-nonce',
+        fn (TestResponse $response) => $response
+            ->assertSee('nonce="test-nonce"', false)
+            ->assertSee('id="browser-logger-active"', false),
+    ],
+    'without CSP nonce configured' => [
+        null,
+        fn (TestResponse $response) => $response
+            ->assertSee('<script id="browser-logger-active">', false)
+            ->assertDontSee('nonce=', false)
+            ->assertDontSee('test-nonce', false),
+    ],
+]);
