Laravel Gtag Laravel Package

Getting Started

• Install with composer require and publish the package's config/views if it ships them (php artisan vendor:publish --tag=...). Most setups need nothing beyond the service provider auto-discovery.
• Look first at the published config file (script placement, attributes, whether the nonce attribute is emitted at all), then at the Blade component/directive the package registers, and finally at the renderer class that builds the <script> tag — that class is where the v3.1.0 nonce logic lives.
• First use case: drop the component/directive into your main layout, load the page, and confirm the tag appears in view-source (not just the DOM inspector) exactly where you placed it.
• Then opt into the new behaviour: generate a per-request nonce in middleware, call Vite::cspNonce($nonce), and confirm the emitted script tag now carries nonce="..." with no other code changes. Apps that never set a nonce see byte-identical output to v3.0.x.

Implementation Patterns

• Single nonce source per response. Generate the nonce once (middleware is the natural home), store it on the request or a scoped container binding, then use the same value for both Vite::cspNonce() and your CSP header. With laravel-security-headers 2.1 the header side is just 'nonce-{nonce}' in script-src; the package side is now automatic.
• Replace 'unsafe-inline', don't stack it. Once the nonce is emitted you can tighten script-src to 'nonce-...' (optionally with 'strict-dynamic'). Leaving 'unsafe-inline' in place means the nonce adds nothing.
• Layout-level placement. Register the package once in the base layout so every page inherits the nonce; avoid scattering multiple instances across partials where you lose track of which script tags exist.
• Per-page overrides. If the package supports config/options at the call site, keep conditional scripts (analytics, widget only on certain routes) driven by config rather than @if blocks around the component — easier to audit against your CSP.
• Testing. Use a fixed test nonce and assert both sides: assertSee('nonce="test-nonce"', false) on the response body and an assertion that your CSP header contains 'nonce-test-nonce'. A mismatch between the two is the most common regression.
• Environment parity. Confirm the tag is nonce-stamped in production builds and when Vite's dev server is running — dev and prod emit scripts through different paths, and it's easy to only verify one.

Gotchas and Tips

• Caching will freeze or strip the nonce. Full-page caches, CDN edge caches, and response caching store the rendered nonce and replay it. Either bypass caching for HTML or inject the nonce at the edge; a stale nonce silently blocks all scripts with no obvious error beyond a console CSP violation.
• Octane / long-lived workers. A nonce generated in a singleton or service-provider boot() can leak across requests. Generate it per request in middleware and reset it explicitly.
• Fragment and view caching. If you cache rendered partials containing the package's output, the nonce is baked in. Cache the surrounding markup and render the script tag outside the cached region.
• Adding a nonce silently kills inline handlers. Browsers ignore 'unsafe-inline' as soon as a nonce or hash is present. Audit onclick= attributes and inline <style>/style= before flipping the policy — they will start failing at the same moment the nonce starts working.
• Dynamically injected scripts aren't covered. Livewire/AJAX/fetch-injected script tags won't match a nonce issued in the original document header. You need 'strict-dynamic' plus a trusted loader, or a different strategy for those.
• Don't double-escape the attribute. The nonce is base64 and safe, but check whether your override of the package's view uses {{ }} (escaped) versus {!! !!} — escaping is correct here; the failure mode is manual string-building that mangles quotes.
• Header/body drift. A nonce with trailing whitespace or a different case in the CSP header vs. the attribute produces a violation that looks identical to "nonce not emitted." Log both values side by side when debugging.
• Extension points. Keep the nonce behaviour in the package's renderer rather than patching markup in your own Blade overrides; if you must customise the tag, extend the bound renderer class (or the published view) so future releases — including further CSP work — continue to flow through.
• Scope of coverage. The nonce only applies to tags this package emits. Third-party CDN snippets still need explicit script-src allowlisting or 'strict-dynamic', so don't assume a clean console means the policy is complete.