Mosparo Bundle Laravel Package

Getting Started

• Upgrade to 1.3.2 and confirm the package’s injected JavaScript script tag now supports a nonce attribute. First place to look is the script-tag rendering path: package config, service provider binding, Blade directive/component, or response middleware.
• First use case: a Laravel app with a strict CSP. Generate a per-request nonce in middleware, expose it to the package, and verify the rendered <script> tag includes nonce="..." matching the Content-Security-Policy header.
• Minimal path: update the package, publish config if required, add nonce middleware before the package’s rendering/middleware, pass the nonce through the documented config/helper/request attribute, clear config and view caches, then inspect the rendered HTML and CSP header.

Implementation Patterns

• Centralize nonce generation in one middleware. Store the nonce on the request, add the CSP header, and let the package read the same value. Avoid generating separate nonces for the header and script tag.
• Pass the nonce through the package’s supported hook: config value, closure/resolver, shared view data, or Blade helper. If the app already uses Laravel’s csp_nonce() helper, wire the package to that helper where possible.
• In tests, assert both the CSP header and the rendered script tag contain the same nonce. For pages with multiple injected scripts, confirm every relevant tag receives the nonce.
• Integration tip: when using Laravel CSP packages, Vite, Livewire, or Inertia, ensure the nonce is available before the package renders. For cached HTML, do not cache per-request nonces unless the nonce strategy explicitly supports it.

Gotchas and Tips

• 1.3.2 appears additive: it adds nonce support to the script tag, with no breaking changes indicated. Still verify the package’s minimum Laravel/PHP constraints and whether nonce support is opt-in.
• The nonce must be cryptographically random per response and safe for HTML attribute output. The most common failure is a mismatch between the CSP header nonce and the script tag nonce.
• Check middleware order: the package may render before nonce middleware runs. Clear config cache after changing nonce settings. If the nonce is missing, inspect the final response HTML, not only the Blade source.
• Per-request nonces break full-page caching. Use a placeholder strategy or disable caching for dynamic/authenticated pages. Escape the nonce correctly, and prefer the package’s resolver/extension point over overriding views. Debug with browser devtools and response headers.