robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

csp update

Browse Source
This commit is contained in:
robbond
2025-06-18 09:09:45 +01:00
parent 4b92f40018
commit 6900d02f8c
1 changed files with 16 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
middleware.js
+16 -14
View File
@@ -4,23 +4,25 @@ export function middleware(request) {
const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
const cspHeader =
`
default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
};
style-src 'self' 'unsafe-eval' 'unsafe-inline';
img-src 'self' 'unsafe-inline' https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com blob: data:;
connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
object-src 'none';
base-uri 'self';
frame-src https://datamap.gov.wales/;
form-action 'self' ` +
style-src 'self' 'unsafe-eval' 'unsafe-inline';
img-src 'self' 'unsafe-inline' https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com blob: data:;
connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
object-src 'none';
base-uri 'self';
frame-src https://datamap.gov.wales/;
form-action 'self' ` +
process.env.NEXTAUTH_URL +
`;
frame-ancestors 'none';
upgrade-insecure-requests;
`;
`;
frame-ancestors 'none';
upgrade-insecure-requests;
`;
//const cspHeader = "";
// csp += `base-uri 'self';`;
// csp += `script-src 'self' 'unsafe-eval' 'unsafe-inline' https://ukwest-0.in.applicationinsights.azure.com https://region1.google-analytics.com https://www.google-analytics.com/ https://tagmanager.google.com/ https://www.googletagmanager.com/;`;