Updated csp and headers

2022-01-18 13:59:44 +00:00
parent 674dcef43e
commit 5af7b78a44
5 changed files with 54 additions and 17 deletions
@@ -2,6 +2,7 @@ import Document, { Html, Head, Main, NextScript } from "next/document";
 import SkipLink from "../components/skiplink";
 import { Tracking, TrackingNoScript } from "../components/tracking";
 import basicAuthMiddleware from "nextjs-basic-auth-middleware";
+import { nanoid } from "nanoid";

 class MyDocument extends Document {
    static async getInitialProps(ctx) {
@@ -38,26 +39,44 @@ class MyDocument extends Document {
    render() {
        const googleTagManagerID = process.env.GOOGLE_TAG_MANAGER || null;
        const { useGATracking } = this.props;
+
+        const generatedNonce = nanoid();
+
+        let csp = ``;
+        csp += `base-uri 'self';`;
+        csp += `form-action 'self';`;
+        csp += `object-src 'none';`;
+        csp += `script-src 'self'  https://www.googletagmanager.com  'nonce-${generatedNonce}' ${
+            process.env.NODE_ENV != "production" ? " 'unsafe-eval';" : " ;"
+        }`;
+        csp += `img-src 'self' https://www.googletagmanager.com https://gov.wales https://www.google-analytics.com 'nonce-${generatedNonce}' data:;`;
+        csp += `style-src 'self' https://fonts.googleapis.com 'unsafe-inline' data:;`;
+
        return (
            <Html lang="en">
                <Head>
+                    <meta httpEquiv="Content-Security-Policy" content={csp} />
                    {useGATracking && (
-                        <Tracking googleTagManagerID={googleTagManagerID} />
+                        <Tracking
+                            googleTagManagerID={googleTagManagerID}
+                            nonce={generatedNonce}
+                        />
                    )}
                </Head>
                <body className="js-enabled">
                    {useGATracking && (
                        <TrackingNoScript
+                            nonce={generatedNonce}
                            googleTagManagerID={googleTagManagerID}
                        />
                    )}
                    {!process.browser && (
                        <>
-                            <script>
+                            <script nonce={generatedNonce}>
                                window.switchDomain = `{process.env.I18N_DOMAIN}
                                `
                            </script>
-                            <script>
+                            <script nonce={generatedNonce}>
                                window.apiRoot = `{process.env.API_ROOT}`
                            </script>
                        </>