Added @cspnonce to all inline <script> and <style> tags in layout,
explorer, and register views. Enabled nonce generation in headers
config. unsafe-inline kept as fallback. Nonces will activate after
container restart when the Headers Boot registers the Blade directive.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The $event->routes() pattern applies SecurityHeaders middleware which
sets CSP. Inline <style> and <script> tags in Blade views need
unsafe-inline to render. Published config from framework with fix.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- /widget.js — drop-in search widget for partner sites
- Dark/light theme via data-theme attribute
- Checks availability, shows reserved/taken/available with register link
- CORS enabled on v1/* for cross-origin widget API calls
- XSS-safe: uses DOM methods, no innerHTML
Embed: <div id="lthn-search"></div><script src="https://lthn.io/widget.js"></script>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
