spatie/laravel-google-fonts

Cache & serve Google Fonts from your application

laravel-google-fonts's Issues

New Preload Breaks Existing Config

Any existing project which has overridden the default config will break when upgrading to 1.3.0 due to the new preload flag not having a value and defaulting to null when it is required to be a bool.

TypeError: Spatie\GoogleFonts\GoogleFonts::__construct(): Argument #7 ($preload) must be of type bool, null given, called in //vendor/spatie/laravel-google-fonts/src/GoogleFontsServiceProvider.php on line 25

Updating the project config to include the preload key fixes this. Suggest adding a default false value for this new key

blocked: mixed content

I get "blocked: mixed content" for all fonts, since they are loaded with HTTP, not with HTTPS:

@font-face {
  font-family: 'Libre Franklin';
  font-style: italic;
  font-weight: 100 900;
  font-display: swap;
  src: url(http://domainname.com/storage/fonts/edf4d99f36/slibrefranklinv14jizbrevithgc8qdibstkq4xkriua6zotjntlgnuz5w.woff2) format('woff2');
  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
}

My APP_URL is with https://

Is this normal or is something wrong with my setup?

Url with no extension?

Suddenly today I am getting an error as the package is getting this url back without an extension.

https://fonts.gstatic.com/l/font?kit=XRXI3I6Li01BKofiOc5wtlZ2di8HDLshdTA3iazbXWjgevT5&skey=27bb6aa8eea8a5e7&v=v26

It is a woff file but GoogleFonts::localizeFontUrl() expects it to have an extension and therefor throws a 500 error. It seems to happen quite randomly, and if I run my test suite it happens at least once.

If I check the font files in the storage directory I dont find this url anywhere, so I expect it comes directly from google.
Is it perhaps possible to ensure it does not query google in tests at all (even if not preloaded)?

Add nonce for CSP

The inline <style> tag generated by the package gets blocked by a content security policy that doesn't allow unsafe-inline styles. Any chance you could add an option in the config to include a call to csp_nonce() in the style tag to pass the CSP?