Add possibility to clear nonces

[arxeiss]

In Laravel app, I have this piece of code View::share('scpScriptNonceToken', SecureHeaders::nonce()); in AppServiceProvider. I used this to prevent generating a big amount of nonces for scripts.

But there is also another reason for this. On sites when is no JS, no nonce is generated. Which then means that someone is able to inject his own script without nonce and it will work. (This would happen really rarely). This will always generate a nonce.

But then, I need to remove nonces for some routes where libraries like FileManager lives. Currently, there is no way how to remove already generated nonces.

---

Hope this is understandable. If not, don't hesitate to ask

[bepsvpt]

Hi @arxeiss,

Sorry for late reply.

In my opinion, when there are some routes do not contain js, isn't it a better approach to exclude those routes from AppServiceProvider?

[arxeiss]

Excluding would be awesome, but when boot method is called, request()->route() returns null. The boot method is called before the Router is initialized. So I would need to do some regex matching on the URI itself. That's why I wanted to add this function.