robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'Development' into SIPS-Development

Browse Source
This commit is contained in:
robbond
2025-04-15 09:29:23 +01:00
parent d6206ee2be 1caab59c05
commit 7c5582f6c2
5 changed files with 94 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
-2
View File
@@ -36,5 +36,3 @@ pages/polling.js
# dev apis to no include
pages/api/endpoint/getaccounts_api.js
pages/auth/signin2.js
components/tracking/index.js
+4 -1
View File
@@ -6,11 +6,13 @@ export const Tracking = ({ googleTagManagerID, nonce, cookieObj }) => {
return (
<Fragment>
<script
nonce={nonce}
async
// strategy="afterInteractive"
src={`https://www.googletagmanager.com/gtag/js?id=${googleTagManagerID}`}
/>
<script
nonce={nonce}
async
id="google-analytics"
// strategy="afterInteractive"
@@ -48,10 +50,11 @@ export const Tracking = ({ googleTagManagerID, nonce, cookieObj }) => {
);
};
export const TrackingNoScript = ({ googleTagManagerID }) => (
export const TrackingNoScript = ({ googleTagManagerID, nonce }) => (
<Fragment>
<noscript>
<iframe
nonce={nonce}
title="google analytics"
src={`https://www.googletagmanager.com/ns.html?id=${googleTagManagerID}`}
height="0"
middleware.js
+79
View File
@@ -0,0 +1,79 @@
import { NextResponse } from "next/server";
export function middleware(request) {
const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
const cspHeader =
`
default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
};
style-src 'self' 'unsafe-eval' 'unsafe-inline';
img-src 'self' 'unsafe-inline' https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com blob: data:;
connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
object-src 'none';
base-uri 'self';
form-action 'self' ` +
process.env.NEXTAUTH_URL +
`;
frame-ancestors 'none';
upgrade-insecure-requests;
`;
// csp += `base-uri 'self';`;
// csp += `script-src 'self' 'unsafe-eval' 'unsafe-inline' https://ukwest-0.in.applicationinsights.azure.com https://region1.google-analytics.com https://www.google-analytics.com/ https://tagmanager.google.com/ https://www.googletagmanager.com/;`;
// csp += `style-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://www.google-analytics.com https://tagmanager.google.com/ https://www.googletagmanager.com/ https://fonts.googleapis.com/;`;
// csp += `img-src 'self' 'unsafe-inline' https://maps.gstatic.com https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://ssl.gstatic.com/ blob: data:;`;
// csp += `connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;`;
// csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
// csp += `object-src 'self' data:;`;
// csp += `default-src 'self' https://www.google-analytics.com;`;
// csp += `font-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://fonts.gstatic.com/ data:;`;
// csp += `frame-src https://datamap.gov.wales`;
// Replace newline characters and spaces
const contentSecurityPolicyHeaderValue = cspHeader
.replace(/\s{2,}/g, " ")
.trim();
const requestHeaders = new Headers(request.headers);
requestHeaders.set("x-nonce", nonce);
requestHeaders.set(
"Content-Security-Policy",
contentSecurityPolicyHeaderValue
);
const response = NextResponse.next({
request: {
headers: requestHeaders,
},
});
response.headers.set(
"Content-Security-Policy",
contentSecurityPolicyHeaderValue
);
return response;
}
// export const config = {
// matcher: [
// /*
// * Match all request paths except for the ones starting with:
// * - api (API routes)
// * - _next/static (static files)
// * - _next/image (image optimization files)
// * - favicon.ico (favicon file)
// */
// {
// source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
// missing: [
// { type: "header", key: "next-router-prefetch" },
// { type: "header", key: "purpose", value: "prefetch" },
// ],
// },
// ],
// };
package.json
+2 -2
View File
@@ -8,7 +8,7 @@
"dev:app": "node ./server/server.js",
"build": "NODE_ENV=production node_modules/next/dist/bin/next build",
"start2": "NODE_ENV=production node ./server/server.js",
"start": "node_modules/next/dist/bin/next start",
"start": "NODE_ENV=production node_modules/next/dist/bin/next start",
"lint": "next lint"
},
"browser": {
@@ -104,4 +104,4 @@
"eslint-plugin-jsdoc": "^48.2.3",
"prisma": "^5.0.0"
}
}
}
pages/_document.js
+9 -3
View File
@@ -28,14 +28,20 @@ class MyDocument extends Document {
path: "/",
});
return { ...initialProps, useGATracking, cookieObj };
const headers = ctx.req?.headers;
const generatedNonce = headers?.["x-nonce"];
return { ...initialProps, useGATracking, cookieObj, generatedNonce };
}
render() {
const googleTagManagerID = process.env.GOOGLE_TAG_MANAGER || null;
const { useGATracking, locale, cookieObj } = this.props;
const generatedNonce = nanoid();
//const generatedNonce = nanoid();
const generatedNonce = this.props.generatedNonce;
console.log("this is the nonce:", generatedNonce);
let csp = ``;
csp += `base-uri 'self';`;
@@ -52,7 +58,7 @@ class MyDocument extends Document {
return (
<Html lang={locale}>
<Head nonce={generatedNonce}>
<meta httpEquiv="Content-Security-Policy" content={csp} />
{/* <meta httpEquiv="Content-Security-Policy" content={csp} /> */}
{useGATracking && (
<Tracking
googleTagManagerID={"G-GTWW3JT03Z"}