Allow publishing of errorPage view - for example for CSP violations

[swilla]

I'm trying to publish to view errorPage.php, so I can add some nonce's to the script tags to allow inline execution. Is it possible to do this? Right now I enable CSP headers locally so I can thoroughly test the policies, but this causes the ignition error pages to white screen.

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'report-sample' cdnjs.cloudflare.com polyfill.io 'nonce-limPubnAgNzzrXJGElhOOkumznqYNyiP'". Either the 'unsafe-inline' keyword, a hash ('sha256-pUoCk4o/QT7wzDlWLeNglgiRHfP1hm2I4gIdzgd2HxQ='), or a nonce ('nonce-...') is required to enable inline execution.

[asantossmw]

I did the same. Would be nice if adding nonce is a configurable option, or add an option to publish the view.

[robtesch]

If you are using the spatie/laravel-csp package, you can also add this to the render function of your Handler.php. Might not be ideal, but seems to work:

        $this->container->singleton(YOUR_POLICY::class, static function ($app) {
            return new YOUR_POLICY();
        });
        app(YOUR_POLICY::class)
            ->addDirective(Directive::SCRIPT, Keyword::UNSAFE_INLINE)
            ->reportOnly()
            ->reportTo('');

if you add that just before the return, it should all work.

[winkbrace]

Is there a proper solution for this yet or should we still write our own workaround?

[jhjvandenbroek]

I just ran into this same issue.

Setting UNSAFE_INLINE for inline script tags would defeat the main purpose of setting CSP headers.

Any better fix possible? I'd like to just add the nonce to the <script> tag