From 58fe6e3eeaf56a963e63340b202a7315fe34507e Mon Sep 17 00:00:00 2001
From: rdbsolutions <rob@rdbsolutions.co.uk>
Date: Fri, 10 Jun 2022 11:12:20 +0100
Subject: [PATCH] added in secret env var for prod

---
 package.json                    |  4 ++--
 pages/_document.js              | 11 +++++------
 pages/api/auth/[...nextauth].js |  1 +
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/package.json b/package.json
index 4dd89e94..be26b246 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "mysql": "^2.18.1",
     "nanoid": "^3.2.0",
     "next": "^12.0.8",
-    "next-auth": "^4.3.1",
+    "next-auth": "^4.3.4",
     "next-connect": "^0.12.2",
     "next-redux-wrapper": "^7.0.5",
     "next-translate": "^1.2.0",
@@ -81,4 +81,4 @@
     "prettier": "2.5.1",
     "prisma": "^3.12.0"
   }
-}
+}
\ No newline at end of file
diff --git a/pages/_document.js b/pages/_document.js
index 6fcf497e..79606d2c 100644
--- a/pages/_document.js
+++ b/pages/_document.js
@@ -44,13 +44,12 @@ class MyDocument extends Document {
 
         let csp = ``;
         csp += `base-uri 'self';`;
-        csp += `form-action 'self';`;
+        csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
         csp += `object-src 'self' data:;`;
-        // csp += `script-src 'self' unsafe-inline https://www.googletagmanager.com  https://maps.googleapis.com 'nonce-${generatedNonce}' ${
-        //     process.env.NODE_ENV != "production" ? " 'unsafe-eval';" : " ;"
-        // }`;
-        csp += `script-src 'self' unsafe-inline https://www.googletagmanager.com  https://maps.googleapis.com 'nonce-${generatedNonce}' 'unsafe-eval';`;
-        //csp += `img-src 'self' https://www.googletagmanager.com https://gov.wales https://www.google-analytics.com 'nonce-${generatedNonce}' data:;`;
+        csp +=
+            `script-src 'self' ` +
+            process.env.NEXTAUTH_URL +
+            ` 'unsafe-inline' https://www.googletagmanager.com  https://maps.googleapis.com 'nonce-${generatedNonce}' 'unsafe-eval';`;
         csp += `style-src 'self' https://fonts.googleapis.com 'unsafe-inline' data:;`;
 
         return (
diff --git a/pages/api/auth/[...nextauth].js b/pages/api/auth/[...nextauth].js
index 65fc0419..fab3f813 100644
--- a/pages/api/auth/[...nextauth].js
+++ b/pages/api/auth/[...nextauth].js
@@ -113,6 +113,7 @@ export default NextAuth({
         }),
     ],
     adapter: PrismaAdapter(prisma),
+    secret: process.env.SECRET,
     session: {
         jwt: true,
         pages: {},