nalalangan/fiddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix web csp for next runtime hydration

Browse Source
This commit is contained in:
Nico 2026-02-15 01:08:07 -08:00
parent eef058027d
commit 19ee02ac6c
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
apps/web/next.config.mjs
View File

@ -1,9 +1,22 @@
const isDev = process.env.NODE_ENV !== "production";
const csp = [
"default-src 'self'",
"img-src 'self' data: blob:",
"style-src 'self' 'unsafe-inline'",
`script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
`connect-src 'self'${isDev ? " ws: wss:" : ""}`,
"frame-ancestors 'none'",
"base-uri 'self'",
"form-action 'self'"
].join("; ");
const securityHeaders = [ const securityHeaders = [
{ key: "X-Content-Type-Options", value: "nosniff" }, { key: "X-Content-Type-Options", value: "nosniff" },
{ key: "X-Frame-Options", value: "DENY" }, { key: "X-Frame-Options", value: "DENY" },
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }, { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" }, { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
{ key: "Content-Security-Policy", value: "default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" } { key: "Content-Security-Policy", value: csp }
]; ];
/** @type {import('next').NextConfig} */ /** @type {import('next').NextConfig} */