Configure CSP

[dsebastien]

#723 is adding the security headers. Now we need to configure the CSP

• Review docs
  • https://github.com/bepsvpt/secure-headers/blob/main/DOCS.md
  • https://github.com/bepsvpt/secure-headers/blob/6.0.0/tests/Builders/ContentSecurityPolicyBuilderTest.php
  • https://content-security-policy.com/strict-dynamic/
• Configure
• Configure for PrimeReact: https://primereact.org/configuration/#nonce
• Configure for Vite: https://laravel.com/docs/11.x/vite#content-security-policy-csp-nonce
• Evaluate with https://csp-evaluator.withgoogle.com/
• Deploy to production
• Evaluate production with: https://securityheaders.com/

[dsebastien]

Laravel references:

• https://github.com/spatie/laravel-csp
• https://laravel-news.com/laravel-content-security-policies
• https://medium.com/@songganjs/managing-content-security-policy-csp-in-laravel-10-e1f228edf97b
• https://www.stackhawk.com/blog/laravel-content-security-policy-guide-what-it-is-and-how-to-enable-it/
• https://hummingbirduk.com/managing-a-content-security-policy-with-laravel