robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

csp fix removed matcher

Browse Source
This commit is contained in:
robbond
2025-04-14 18:00:30 +01:00
parent 99e2db34ae
commit 8f1b2b63b4
2 changed files with 27 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/tracking/index.js
+1 -1
View File
@@ -50,7 +50,7 @@ export const Tracking = ({ googleTagManagerID, nonce, cookieObj }) => {
); );
}; };
export const TrackingNoScript = ({ nonce, googleTagManagerID }) => ( export const TrackingNoScript = ({ googleTagManagerID, nonce }) => (
<Fragment> <Fragment>
<noscript> <noscript>
<iframe <iframe
middleware.js
+26 -24
View File
@@ -2,21 +2,23 @@ import { NextResponse } from "next/server";
export function middleware(request) { export function middleware(request) {
const nonce = Buffer.from(crypto.randomUUID()).toString("base64"); const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
const cspHeader = ` const cspHeader =
`
default-src 'self'; default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${ script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'` process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
}; };
style-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-eval' 'unsafe-inline';
img-src 'self' blob: data:; img-src 'self' 'unsafe-inline' https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com blob: data:;
connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com; connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ; font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
object-src 'none'; object-src 'none';
base-uri 'self'; base-uri 'self';
form-action 'self' ${process.env.NEXTAUTH_URL}; form-action 'self' ` +
process.env.NEXTAUTH_URL +
`;
frame-ancestors 'none'; frame-ancestors 'none';
upgrade-insecure-requests; upgrade-insecure-requests;
frame-src https://datamap.gov.wales;
`; `;
// csp += `base-uri 'self';`; // csp += `base-uri 'self';`;
@@ -57,21 +59,21 @@ export function middleware(request) {
return response; return response;
} }
export const config = { // export const config = {
matcher: [ // matcher: [
/* // /*
* Match all request paths except for the ones starting with: // * Match all request paths except for the ones starting with:
* - api (API routes) // * - api (API routes)
* - _next/static (static files) // * - _next/static (static files)
* - _next/image (image optimization files) // * - _next/image (image optimization files)
* - favicon.ico (favicon file) // * - favicon.ico (favicon file)
*/ // */
{ // {
source: "/((?!api|_next/static|_next/image|favicon.ico).*)", // source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
missing: [ // missing: [
{ type: "header", key: "next-router-prefetch" }, // { type: "header", key: "next-router-prefetch" },
{ type: "header", key: "purpose", value: "prefetch" }, // { type: "header", key: "purpose", value: "prefetch" },
], // ],
}, // },
], // ],
}; // };