feat(sec): add security headers #311
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
42tte
commented
Oct 21, 2022
| default-src 'self'; | ||
| connect-src 'self' https://variant.innocraft.cloud/; | ||
| script-src 'self' 'sha256-j6xN8x073Dhm+Ee4HKwIIRXsHIqI5aIRHC0pgnhVcJY=' https://variant.innocraft.cloud/ ${ | ||
| process.env.NODE_ENV !== 'production' ? "'unsafe-eval'" : '' |
There was a problem hiding this comment.
'unsafe-eval' needed for hot reload in dev build
42tte
commented
Oct 21, 2022
| const ContentSecurityPolicy = ` | ||
| default-src 'self'; | ||
| connect-src 'self' https://variant.innocraft.cloud/; | ||
| script-src 'self' 'sha256-j6xN8x073Dhm+Ee4HKwIIRXsHIqI5aIRHC0pgnhVcJY=' https://variant.innocraft.cloud/ ${ |
There was a problem hiding this comment.
Should have used 'strict-dynamic' but there is no good way of using generated nonces in Nextjs vercel/next.js#21587
42tte
force-pushed
the
42tte/feat-security-headers
branch
from
0e2aac9
to
40489d4
Compare
|
Haven't gone through all potential external references here, but at a glance it looks to cover the things I can think of at least. Now there will be a new implementation of variant webpage, so this would have to be ported over. In that port I also think we could transition to using middleware which I belive now can support nonce. |
mikaelbr
approved these changes
Sep 4, 2024
42tte
force-pushed
the
42tte/feat-security-headers
branch
from
40489d4
to
827ffa5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
About Nextjs security headers https://nextjs.org/docs/advanced-features/security-headers
About CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy