Laravel app rejection in shopify with osiset package

[Anshu-Shar]

Hello Team,
my app has been rejected due to App must set security headers to protect against clickjacking.
I created the app in laravel using osiset package. and implemented the code for clickjacking by creating the middleware in the app/Http/Middleware/ContentSecurityPolicy.php folder.

[Anonymous]

@Anshu-Shar   I can see the osiset package was not up to date.

i can't find the same file on the git repo  https://github.com/osiset/laravel-shopify/tree/master/src/Http/Middleware i think this file created by you. you can change the header 

here is some reference  that will help you fixed the your issue

https://laracasts.com/discuss/channels/laravel/iframe-and-x-frame-options

https://www.getastra.com/blog/php-security/prevent-clickjacking-in-php/

code example ```

.setHeader(

"Content-Security-Policy",

`frame-ancestors https://${shop} https://admin.shopify.com;`

```

[Anshu-Shar]

@Anonymous 

Yes, I have created my own middleware with frame-ancestors code like the below:-
protected const HEADER_FORMAT='frame-ancestors %s %s';
protected const ADMIN_SHOPIFY_URL='https://admin.shopify.com';
public function handle(Request $request, Closure $next)
{
$response= $next($request);
if ($response instanceof HttpResponse && !$request->ajax()) {
if ($request->has('shop')) {
$shopDomain=ShopDomain::fromNative($request->get('shop'));
} elseif ($request->user() instanceof User) {
$shopDomain=$request->user()->getDomain();
} else {
$shopDomain=ShopDomain::fromNative($request->getContent());
}

if ($shopDomain instanceof ShopDomain) {
$response->headers->set('Content-Security-Policy', sprintf(self::HEADER_FORMAT, 'https://'.$shopDomain->toNative(), self::ADMIN_SHOPIFY_URL));
}
}
return $response;
}

and register it in the app/Http/kernel.php protected $middleware = [
\App\Http\Middleware\ContentSecurityPolicy::class
]

Thanks for giving me the valuable suggestion. but can you check implemented code above that it has any issues?

[Anonymous]

@Anshu-Shar  I think you still header format is missing the format you can refer this guide

https://community.shopify.com/c/technical-q-a/how-to-fix-quot-app-must-set-security-headers-to-prote...

here one shopify accepted answer write in node js you have to do similer in php laravel 

https://www.shopside.com.au/post/solving-shopifys-content-security-policies-requirement  

Read this https://shopify.dev/apps/store/security/iframe-protection  here full detail explain by the shopify  

[Anshu-Shar]

@Anonymous 

I have set the header in the middleware code you can see the screenshots and let me know if something missing on that.

[Anonymous]

@Anshu-Shar   yes it's was correct.