diff --git a/README.md b/README.md index 3dbd9ad..b2b04e0 100644 --- a/README.md +++ b/README.md @@ -98,6 +98,14 @@ So we will not preload these images. If your html object tag contains `data=""` it will preload it. +##### Nonce + +While the early hints module does support sending [nonce](https://laravel.com/docs/11.x/vite#content-security-policy-csp-nonce) across as well, we recommend against it. And use [integrity](https://laravel.com/docs/11.x/vite#subresource-integrity-sri) instead. + +Without hardcoding the nonce +[Vite::useCspNonce($nonce);](https://laravel.com/docs/11.x/vite#content-security-policy-csp-nonce:~:text=Vite%3A%3AuseCspNonce(%24nonce)%3B) +sending this in early hints will be useless as each request will send early hints with a stale nonce. + ## Testing ``` bash diff --git a/src/Listeners/AddFromBody.php b/src/Listeners/AddFromBody.php index 1cb3f46..b54573b 100644 --- a/src/Listeners/AddFromBody.php +++ b/src/Listeners/AddFromBody.php @@ -21,7 +21,7 @@ public function handle(GenerateEarlyHints $event) $excludeKeywords = array_filter(config('http3earlyhints.exclude_keywords', [])); $headers = $this->fetchLinkableNodes($event->response) ->flatMap(function ($element) { - [$src, $href, $data, $rel, $type, $crossorigin, $as, $fetchpriority, $integrity, $referrerpolicy, $imagesizes, $imagesrcset] = $element; + [$src, $href, $data, $rel, $type, $crossorigin, $as, $fetchpriority, $integrity, $nonce, $referrerpolicy] = $element; $rel = $type === 'module' ? 'modulepreload' : $rel; if ($rel === 'modulepreload' && empty($crossorigin)) { @@ -29,7 +29,7 @@ public function handle(GenerateEarlyHints $event) $crossorigin = 'anonymous'; } - $attributes = array_filter(@compact('crossorigin', 'as', 'fetchpriority', 'integrity', 'referrerpolicy', 'imagesizes', 'imagesrcset')); + $attributes = array_filter(@compact('crossorigin', 'as', 'fetchpriority', 'integrity', 'nonce', 'referrerpolicy')); return [ $this->buildLinkHeader($href ?? '', $rel ?? null, $attributes), @@ -71,7 +71,7 @@ protected function fetchLinkableNodes(Response $response): Collection return collect( $crawler->filter('link:not([rel*="icon"]):not([rel="canonical"]):not([rel="manifest"]):not([rel="alternate"]), script[src]:not([defer]):not([async]), *:not(picture)>img[src]:not([loading="lazy"]), object[data]') - ->extract(['src', 'href', 'data', 'rel', 'type', 'crossorigin', 'as', 'fetchpriority', 'integrity', 'referrerpolicy', 'imagesizes', 'imagesrcset']) + ->extract(['src', 'href', 'data', 'rel', 'type', 'crossorigin', 'as', 'fetchpriority', 'integrity', 'nonce', 'referrerpolicy']) ); }