---
description: How to set a Content Security Policy in Laravel with middleware and Vite's built-in CSP nonce support, and report violations to Report URI.
---

# Laravel

Laravel has no first-party CSP configuration, but it does have first-party *nonce* support through Vite - which solves the hard half of the problem. Once you call `Vite::useCspNonce()`, Laravel attaches the nonce to every script and style tag it generates for you, and you only have to set the header yourself.

## What Laravel gives you

- `Vite::useCspNonce()` to generate a nonce for the request, and `Vite::cspNonce()` to read it back.
- Automatic `nonce` attributes on all script and style tags generated by the Vite directive after `useCspNonce()` has been called.
- The ability to pass in an existing nonce, if it is generated further up your stack.
- Standard middleware as the place to set the header.

## Setting the header

Create a middleware that generates the nonce and sets the header. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

```php
public function handle(Request $request, Closure $next): Response
{
    Vite::useCspNonce();

    $response = $next($request);

    $response->headers->set('Content-Security-Policy-Report-Only', implode('; ', [
        "default-src 'self'",
        "script-src 'self' 'nonce-" . Vite::cspNonce() . "'",
        'report-uri https://abc123.report-uri.com/r/d/csp/reportOnly',
    ]));

    return $response;
}
```

Register it in your middleware stack, and switch the header name to `Content-Security-Policy` and the endpoint to `enforce` when you are ready.

## Adding a nonce

`Vite::useCspNonce()` does the work. Anything rendered through the `@vite` directive picks the nonce up automatically; for inline scripts you write yourself, add it by hand:

```blade
<script nonce="{{ Vite::cspNonce() }}">
  // allowed by the policy
</script>
```

## Things to watch for

- `useCspNonce()` has to run **before** the response is rendered. Calling it after `$next($request)` gives you a nonce in the header that no tag on the page carries.
- Full-page response caching and a nonce-based policy are incompatible. If you cache rendered HTML, either exclude those routes or move to a hash-based policy.
- Livewire pages have their own considerations for CSP - check Livewire's documentation alongside this if you are running it.

## Official documentation

[Laravel - Asset Bundling (Vite): Content Security Policy Nonce](https://laravel.com/docs/12.x/vite)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)