How can I use spatie/laravel-responsecache with spatie/laravel-csp nonce together.

[onurakman]

How can I use spatie/laravel-responsecache with spatie/laravel-csp together. I will be glad if you help.

[uintaam]

If your issue is you're concerned with the nonce being the same for all cached responses then I created a replacer class you add to your responsecache.php config file.

<?php declare(strict_types = 1);

namespace App\Csp;

use Spatie\ResponseCache\Replacers\Replacer;
use Symfony\Component\HttpFoundation\Response;

class NonceTokenReplacer implements Replacer
{
    protected string $replacementString = '<laravel-responsecache-cspnonce-token-here>';

    public function prepareResponseToCache(Response $response): void
    {
        $csp_header_name = 'content-security-policy';
        $csp_header = $response->headers->get($csp_header_name);
        if (!$csp_header) {
            $csp_header_name = 'content-security-policy-report-only';
            $csp_header = $response->headers->get($csp_header_name);
        }

        if (! $csp_header || ! $response->getContent()) {
            return;
        }

        $response->headers->replace([$csp_header_name => str_replace(
            csp_nonce(),
            $this->replacementString,
            $csp_header
        )]);

        $response->setContent(str_replace(
            csp_nonce(),
            $this->replacementString,
            $response->getContent()
        ));
    }

    public function replaceInCachedResponse(Response $response): void
    {
        $csp_header_name = 'content-security-policy';
        $csp_header = $response->headers->get($csp_header_name);
        if (!$csp_header) {
            $csp_header_name = 'content-security-policy-report-only';
            $csp_header = $response->headers->get($csp_header_name);
        }

        if (! $csp_header || ! $response->getContent()) {
            return;
        }

        $response->headers->replace([$csp_header_name => str_replace(
            $this->replacementString,
            csp_nonce(),
            $csp_header
        )]);

        $response->setContent(str_replace(
            $this->replacementString,
            csp_nonce(),
            $response->getContent()
        ));
    }
}