From 0114d4bacac64331bb24ee047adc59fa209ef2d2 Mon Sep 17 00:00:00 2001
From: Simon Hamp <simon.hamp@me.com>
Date: Fri, 23 Oct 2026 00:36:09 +0100
Subject: [PATCH] Only upgrade insecure requests outside local

The upgrade-insecure-requests CSP meta made the browser fetch every
asset over https. On a Herd site that hasn't been secured those
requests fail, Alpine never loads, and the x-cloak on <body> keeps the
page blank. Leave the meta out when APP_ENV is local so a fresh clone
or worktree can be previewed over plain http. Other environments still
get it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 resources/views/components/layout.blade.php   | 11 ++--
 .../views/components/layouts/auth.blade.php   |  5 +-
 .../components/layouts/dashboard.blade.php    | 11 ++--
 tests/Feature/UpgradeInsecureRequestsTest.php | 63 +++++++++++++++++++
 4 files changed, 81 insertions(+), 9 deletions(-)
 create mode 100644 tests/Feature/UpgradeInsecureRequestsTest.php

diff --git a/resources/views/components/layout.blade.php b/resources/views/components/layout.blade.php
index 599808331..42dab2a66 100644
--- a/resources/views/components/layout.blade.php
+++ b/resources/views/components/layout.blade.php
@@ -32,10 +32,13 @@
     x-bind:class="{ 'dark': isDark === true }"
 >
     <head>
-        <meta
-            http-equiv="Content-Security-Policy"
-            content="upgrade-insecure-requests"
-        />
+        {{-- Skipped locally so the site can be served over plain http --}}
+        @unless (app()->isLocal())
+            <meta
+                http-equiv="Content-Security-Policy"
+                content="upgrade-insecure-requests"
+            />
+        @endunless
         <meta charset="utf-8" />
         <meta
             http-equiv="X-UA-Compatible"
diff --git a/resources/views/components/layouts/auth.blade.php b/resources/views/components/layouts/auth.blade.php
index a70f67bed..f85e51f43 100644
--- a/resources/views/components/layouts/auth.blade.php
+++ b/resources/views/components/layouts/auth.blade.php
@@ -23,7 +23,10 @@
     x-bind:class="{ 'dark': isDark === true }"
 >
     <head>
-        <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests" />
+        {{-- Skipped locally so the site can be served over plain http --}}
+        @unless (app()->isLocal())
+            <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests" />
+        @endunless
         <meta charset="utf-8" />
         <meta http-equiv="X-UA-Compatible" content="IE=edge" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
diff --git a/resources/views/components/layouts/dashboard.blade.php b/resources/views/components/layouts/dashboard.blade.php
index ae2f5548b..54dd23668 100644
--- a/resources/views/components/layouts/dashboard.blade.php
+++ b/resources/views/components/layouts/dashboard.blade.php
@@ -32,10 +32,13 @@
     x-bind:class="{ 'dark': isDark === true }"
 >
     <head>
-        <meta
-            http-equiv="Content-Security-Policy"
-            content="upgrade-insecure-requests"
-        />
+        {{-- Skipped locally so the site can be served over plain http --}}
+        @unless (app()->isLocal())
+            <meta
+                http-equiv="Content-Security-Policy"
+                content="upgrade-insecure-requests"
+            />
+        @endunless
         <meta charset="utf-8" />
         <meta
             http-equiv="X-UA-Compatible"
diff --git a/tests/Feature/UpgradeInsecureRequestsTest.php b/tests/Feature/UpgradeInsecureRequestsTest.php
new file mode 100644
index 000000000..66ef93c6d
--- /dev/null
+++ b/tests/Feature/UpgradeInsecureRequestsTest.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Features\ShowAuthButtons;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Pennant\Feature;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\TestCase;
+
+class UpgradeInsecureRequestsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Feature::define(ShowAuthButtons::class, true);
+    }
+
+    public static function pages(): array
+    {
+        return [
+            'main layout' => ['/docs/mobile/3/getting-started/introduction', false],
+            'auth layout' => ['/login', false],
+            'dashboard layout' => ['/dashboard', true],
+        ];
+    }
+
+    #[Test]
+    #[DataProvider('pages')]
+    public function pages_upgrade_insecure_requests_outside_local(string $uri, bool $signedIn): void
+    {
+        $this->app['env'] = 'production';
+
+        $this->getPage($uri, $signedIn)
+            ->assertStatus(200)
+            ->assertSee('content="upgrade-insecure-requests"', false);
+    }
+
+    #[Test]
+    #[DataProvider('pages')]
+    public function pages_do_not_upgrade_insecure_requests_locally(string $uri, bool $signedIn): void
+    {
+        $this->app['env'] = 'local';
+
+        $this->getPage($uri, $signedIn)
+            ->assertStatus(200)
+            ->assertDontSee('upgrade-insecure-requests', false);
+    }
+
+    private function getPage(string $uri, bool $signedIn)
+    {
+        if ($signedIn) {
+            $this->actingAs(User::factory()->create());
+        }
+
+        return $this->withoutVite()->get($uri);
+    }
+}