fix: ensure CSP nonces are Base64 encoded

Author: paulbalandan

system/HTTP/ContentSecurityPolicy.php

@@ -303,7 +303,7 @@ public function enabled(): bool
     public function getStyleNonce(): string
     {
         if ($this->styleNonce === null) {
-            $this->styleNonce = bin2hex(random_bytes(12));
+            $this->styleNonce = base64_encode(random_bytes(12));
             $this->styleSrc[] = 'nonce-' . $this->styleNonce;
         }
 
@@ -316,7 +316,7 @@ public function getStyleNonce(): string
     public function getScriptNonce(): string
     {
         if ($this->scriptNonce === null) {
-            $this->scriptNonce = bin2hex(random_bytes(12));
+            $this->scriptNonce = base64_encode(random_bytes(12));
             $this->scriptSrc[] = 'nonce-' . $this->scriptNonce;
         }
 

tests/system/HTTP/ContentSecurityPolicyTest.php

@@ -578,18 +578,20 @@ public function testGetScriptNonce(): void
     {
         $this->prepare();
 
-        $nonce = $this->csp->getScriptNonce();
-
-        $this->assertMatchesRegularExpression('/\A[0-9a-z]{24}\z/', $nonce);
+        $this->assertMatchesRegularExpression(
+            '/\A[a-zA-Z0-9+\/-_]+[=]{0,2}\z/',
+            $this->csp->getScriptNonce(),
+        );
     }
 
     public function testGetStyleNonce(): void
     {
         $this->prepare();
 
-        $nonce = $this->csp->getStyleNonce();
-
-        $this->assertMatchesRegularExpression('/\A[0-9a-z]{24}\z/', $nonce);
+        $this->assertMatchesRegularExpression(
+            '/\A[a-zA-Z0-9+\/-_]+[=]{0,2}\z/',
+            $this->csp->getStyleNonce(),
+        );
     }
 
     #[PreserveGlobalState(false)]

user_guide_src/source/changelogs/v4.6.5.rst

@@ -31,6 +31,7 @@ Bugs Fixed
 **********
 
 - **Database:** Fixed a bug where ``Seeder::call()`` did not pass the database connection to child seeders, causing them to use the default connection instead of the one specified via ``Database::seeder('group')``.
+- **HTTP:** Updated the Content Security Policy nonce generation to use base64 encoding instead of hexadecimal, ensuring compatibility with CSP specifications.
 
 See the repo's
 `CHANGELOG.md <https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md>`_