Security Hardened

Articles

• Laravel

  Inertia Needs No Patch for a Nonce-Based CSP

  Try to drop 'unsafe-inline' from the Content-Security-Policy of a Laravel + Inertia app and you'll usually land on some version of: "Inertia embeds the initial props in an inline script, so you can't — you'd have to patch Inertia or Handle…

  2026-07-23 GitHub

• Implementing Content-Security-Policy in Laravel

  Content-Security-Policy (CSP) is the last defense layer that stops XSS damage in the browser. The server declares "these are the only scripts allowed to run and resources allowed to load on this page," and the browser rejects everything el…

  2026-04-19
• Laravel

  Laravel + Livewire Starter Kit: nonce-based CSP

  The SetSecurityHeaders middleware shipped in our Livewire Starter Kit Docker-verified fork kept 'unsafe-inline' in script-src and style-src. That was a deliberate placeholder to match the React/Vue forks; the Livewire architecture doesn't …

  2026-04-19 GitHub
• Laravel

  Hardening the Livewire Starter Kit

  We took the official laravel/livewire-starter-kit (Livewire v4 + Flux + Alpine), ran it inside Docker, and published a production-hardened fork. Tests go from the upstream 33 passed to 37 passed / 92 assertions — re-run in Docker on 2026-0…

  2026-04-19 GitHub
• Laravel

  Hardening the shared Laravel starter-kit backend

  Laravel's official starter kits (React / Vue / Livewire) differ in their frontend layer, but they share the same Laravel + Fortify backend code. So most of the production-hardening work is identical across all three. This is the pillar art…

  2026-04-18