Merged PR 865: update env vars

Related work items: #7708

.env.local

@@ -86,6 +86,6 @@ EMAIL_SERVER_PASSWORD=SG.MmrpYiipRVOySFZzyc_Vlg.5sTUinwotLsINleWyExnqgeHLjlm4V1A
 EMAIL_FROM=rob@rdbsolutions.co.uk
 
 NEXTAUTH_URL=http://localhost:3000
+NEXTAUTH_URL_INTERNAL=http://localhost:3000 
 DATABASE_URL=mysql://nextAuthAdmin:!Sky9fish1972@77.68.17.157:3306/nextauthDB?synchronise=true
-
 SECRET=SuperSecret

package.json

@@ -40,7 +40,7 @@
     "mysql": "^2.18.1",
     "nanoid": "^3.2.0",
     "next": "^12.0.8",
-    "next-auth": "^4.3.1",
+    "next-auth": "^4.3.4",
     "next-connect": "^0.12.2",
     "next-redux-wrapper": "^7.0.5",
     "next-translate": "^1.2.0",
@@ -81,4 +81,4 @@
     "prettier": "2.5.1",
     "prisma": "^3.12.0"
   }
-}
+}

pages/_document.js

@@ -44,13 +44,12 @@ class MyDocument extends Document {
 
         let csp = ``;
         csp += `base-uri 'self';`;
-        csp += `form-action 'self';`;
+        csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
         csp += `object-src 'self' data:;`;
-        // csp += `script-src 'self' unsafe-inline https://www.googletagmanager.com  https://maps.googleapis.com 'nonce-${generatedNonce}' ${
+        csp +=
-        //     process.env.NODE_ENV != "production" ? " 'unsafe-eval';" : " ;"
+            `script-src 'self' ` +
-        // }`;
+            process.env.NEXTAUTH_URL +
-        csp += `script-src 'self' unsafe-inline https://www.googletagmanager.com  https://maps.googleapis.com 'nonce-${generatedNonce}' 'unsafe-eval';`;
+            ` 'unsafe-inline' https://www.googletagmanager.com  https://maps.googleapis.com 'nonce-${generatedNonce}' 'unsafe-eval';`;
-        //csp += `img-src 'self' https://www.googletagmanager.com https://gov.wales https://www.google-analytics.com 'nonce-${generatedNonce}' data:;`;
         csp += `style-src 'self' https://fonts.googleapis.com 'unsafe-inline' data:;`;
 
         return (

pages/api/auth/[...nextauth].js

@@ -113,6 +113,7 @@ export default NextAuth({
         }),
     ],
     adapter: PrismaAdapter(prisma),
+    secret: process.env.SECRET,
     session: {
         jwt: true,
         pages: {},