Removed proxy and added api calls, has gov gateway auth

next.config.js

@@ -27,14 +27,30 @@ const securityHeaders = [
         key: "X-Frame-Options",
         value: "SAMEORIGIN",
     },
+    {
+        key: "X-Content-Type-Options",
+        value: "nosniff",
+    },
+    {
+        key: "X-Permitted-Cross-Domain-Policies",
+        value: "none",
+    },
+    {
+        key: "Referrer-Policy",
+        value: "origin-when-cross-origin", //no-referrer
+    },
     {
         key: "Strict-Transport-Security",
         value: "max-age=63072000; includeSubDomains; preload",
     },
     {
-        key: "Content-Security-Policy",
-        value: "frame-src 'self'; child-src 'self'",
+        key: "X-XSS-Protection",
+        value: "1; mode=block",
     },
+    // {
+    //     key: "Content-Security-Policy",
+    //     value: "frame-src 'self'; child-src 'self';object-src 'none'; script-src 'self' 'https://www.googletagmanager.com' unsafe-inline",
+    // },
 ];
 
 module.exports = {
@@ -42,7 +58,7 @@ module.exports = {
         return [
             {
                 // Apply these headers to all routes in your application.
-                source: "/(.*)",
+                source: "/(.*)?",
                 headers: securityHeaders,
             },
         ];