91 lines
3.7 KiB
JavaScript
91 lines
3.7 KiB
JavaScript
import { NextResponse } from "next/server";
|
|
|
|
export function middleware(request) {
|
|
const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
|
|
const cspHeader =
|
|
`
|
|
default-src 'self';
|
|
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
|
|
process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
|
|
};
|
|
style-src 'self' 'unsafe-eval' 'unsafe-inline';
|
|
img-src 'self' 'unsafe-inline' https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com blob: data:;
|
|
connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
|
|
font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
|
|
object-src 'none';
|
|
base-uri 'self';
|
|
frame-src https://datamap.gov.wales/;
|
|
form-action 'self' ` +
|
|
process.env.NEXTAUTH_URL +
|
|
`;
|
|
frame-ancestors 'none';
|
|
upgrade-insecure-requests;
|
|
`;
|
|
|
|
//const cspHeader = "";
|
|
|
|
// csp += `base-uri 'self';`;
|
|
// csp += `script-src 'self' 'unsafe-eval' 'unsafe-inline' https://ukwest-0.in.applicationinsights.azure.com https://region1.google-analytics.com https://www.google-analytics.com/ https://tagmanager.google.com/ https://www.googletagmanager.com/;`;
|
|
// csp += `style-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://www.google-analytics.com https://tagmanager.google.com/ https://www.googletagmanager.com/ https://fonts.googleapis.com/;`;
|
|
// csp += `img-src 'self' 'unsafe-inline' https://maps.gstatic.com https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://ssl.gstatic.com/ blob: data:;`;
|
|
// csp += `connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;`;
|
|
|
|
// csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
|
|
// csp += `object-src 'self' data:;`;
|
|
// csp += `default-src 'self' https://www.google-analytics.com;`;
|
|
|
|
// csp += `font-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://fonts.gstatic.com/ data:;`;
|
|
// csp += `frame-src https://datamap.gov.wales`;
|
|
|
|
// Replace newline characters and spaces
|
|
const contentSecurityPolicyHeaderValue = cspHeader
|
|
.replace(/\s{2,}/g, " ")
|
|
.trim();
|
|
|
|
const requestHeaders = new Headers(request.headers);
|
|
// Unique trusted nonce
|
|
requestHeaders.set("x-nonce", nonce);
|
|
|
|
// CSP policy
|
|
requestHeaders.set(
|
|
"Content-Security-Policy",
|
|
contentSecurityPolicyHeaderValue
|
|
);
|
|
|
|
const response = NextResponse.next({
|
|
request: {
|
|
headers: requestHeaders,
|
|
},
|
|
});
|
|
response.headers.set(
|
|
"Content-Security-Policy",
|
|
contentSecurityPolicyHeaderValue
|
|
);
|
|
|
|
// XSS protection (legacy)
|
|
response.headers.set("X-XSS-Protection", "1; mode=block");
|
|
|
|
// Prevent MIME type sniffing
|
|
response.headers.set("X-Content-Type-Options", "nosniff");
|
|
|
|
// Prevent iframe embedding
|
|
response.headers.set("X-Frame-Options", "DENY");
|
|
|
|
// Referrer policy
|
|
response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
|
|
|
|
// Permissions lockdown
|
|
response.headers.set(
|
|
"Permissions-Policy",
|
|
"geolocation=(), camera=(), microphone=(), fullscreen=(self)"
|
|
);
|
|
|
|
// Enforce HTTPS via HSTS
|
|
response.headers.set(
|
|
"Strict-Transport-Security",
|
|
"max-age=63072000; includeSubDomains; preload"
|
|
);
|
|
|
|
return response;
|
|
}
|