Laravel - Toolbar does not load with strict Content Security Policy Headers (CSP)

[magicyoda]

I'm using Laravel CSP package to define strict CSP header.
In order to work, each <script> tag requires a nonce value.

Telescope toolbar does not support it and does not load correctly:

All these elements should get the nonce value in order to comply with strict CSP header:

    <script src="https://xx.yy.com/_tt/assets/base.js?20190826"></script>
    <link href="https://xx.yy.com/_tt/assets/styling.css?20190826&lightMode=0" rel="stylesheet">
    <script>
        /*<![CDATA[*/
        (function() {
            Sfjs.requestStack.push({
                "error": false,
                "duration": 731,
                "statusCode": 200,
                "url": "\/",
                "method": "GET",
                "profile": "9d632c73-a308-437e-a551-b6810a460723",
                "profilerUrl": "https:\/\/xx.yy.com\/_tt\/show\/9d632c73-a308-437e-a551-b6810a460723",
                "type": "doc"
            });
        }
        )();
        /*]]>*/
    </script>
    <!-- End of Telescope Toolbar assets !-->

I see in the code, that it seems to be supported when variable $csp_script_nonce is present. But how to define it and get it from spatie CSP package ?

https://github.com/fruitcake/laravel-telescope-toolbar/blob/master/resources/views/head.blade.php

[barryvdh]

Can you use View::share() to set the variable?

[magicyoda]

Thank you very much @barryvdh , I could remove the issue for telescope-toolbar using following code in my LaravelViteNonceGenerator.php

class LaravelViteNonceGenerator implements NonceGenerator
{
    public function generate(): string
    {
        $nonce = Vite::useCspNonce();
        view()->share('csp_script_nonce', $nonce);
        
        return $nonce;
    }
}

However, now, I discovered that telescope itself is not working properly with strict CSP:

It's always the same with CSP.. one step after the other until I get finally blocked ;-)
Locally I had to disable strict CSP but I wanted to use Telescope on my hosted "Dev" env. which has strict CSP (PROD near).