From 8a21996add0fea4f4674b943f9a4d7580ed7fc5e Mon Sep 17 00:00:00 2001
From: Claude <developers@lethean.io>
Date: Sat, 4 Apr 2026 10:22:38 +0100
Subject: [PATCH] security: add CSP nonce attributes to inline scripts and
 styles

Added @cspnonce to all inline <script> and <style> tags in layout,
explorer, and register views. Enabled nonce generation in headers
config. unsafe-inline kept as fallback. Nonces will activate after
container restart when the Headers Boot registers the Blade directive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 app/Mod/Explorer/Views/index.blade.php     | 2 +-
 app/Mod/Names/Views/register.blade.php     | 2 +-
 app/Website/Lethean/Views/layout.blade.php | 4 ++--
 config/headers.php                         | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/app/Mod/Explorer/Views/index.blade.php b/app/Mod/Explorer/Views/index.blade.php
index bbe5f41..04b7911 100644
--- a/app/Mod/Explorer/Views/index.blade.php
+++ b/app/Mod/Explorer/Views/index.blade.php
@@ -77,7 +77,7 @@
         <a href="/names">Name directory &rarr;</a>
     </div>
 
-    <script>
+    <script @cspnonce>
     (function() {
         var feed = document.getElementById('feed-entries');
         var dot = document.getElementById('feed-dot');
diff --git a/app/Mod/Names/Views/register.blade.php b/app/Mod/Names/Views/register.blade.php
index 32e114d..4a17ac6 100644
--- a/app/Mod/Names/Views/register.blade.php
+++ b/app/Mod/Names/Views/register.blade.php
@@ -42,7 +42,7 @@
     </div>
 </div>
 
-<script>
+<script @cspnonce>
 (function() {
     var input = document.getElementById('name-input');
     var btn = document.getElementById('check-btn');
diff --git a/app/Website/Lethean/Views/layout.blade.php b/app/Website/Lethean/Views/layout.blade.php
index 2d40057..9dcddc5 100644
--- a/app/Website/Lethean/Views/layout.blade.php
+++ b/app/Website/Lethean/Views/layout.blade.php
@@ -48,7 +48,7 @@
     </script>
     @endverbatim
     @yield('schema')
-    <style>
+    <style @cspnonce>
         :root {
             --bg: #0a0e17; --surface: #111827; --border: #1f2937;
             --text: #e5e7eb; --muted: #9ca3af; --accent: #818cf8;
@@ -96,7 +96,7 @@
 
         code { background: var(--surface); padding: 0.125rem 0.375rem; border-radius: 0.25rem; font-size: 0.85em; }
     </style>
-    <script>window.LTHN_API = '{{ config('chain.api_url', '') }}';</script>
+    <script @cspnonce>window.LTHN_API = '{{ config('chain.api_url', '') }}';</script>
 </head>
 <body>
     <nav>
diff --git a/config/headers.php b/config/headers.php
index 97c6b3e..607d03b 100644
--- a/config/headers.php
+++ b/config/headers.php
@@ -82,7 +82,7 @@ return [
         // Enable nonce-based CSP. Disabled by default because Livewire and
         // Alpine inject inline scripts/styles that cannot carry nonces.
         // Enable only if your app does not use Livewire.
-        'nonce_enabled' => env('SECURITY_CSP_NONCE_ENABLED', false),
+        'nonce_enabled' => env('SECURITY_CSP_NONCE_ENABLED', true),
 
         // Nonce length in bytes (16 = 128 bits, recommended minimum)
         'nonce_length' => env('SECURITY_CSP_NONCE_LENGTH', 16),
