80 lines
3.5 KiB
JavaScript
80 lines
3.5 KiB
JavaScript
import { NextResponse } from "next/server";
|
|
|
|
export function middleware(request) {
|
|
const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
|
|
const cspHeader =
|
|
`
|
|
default-src 'self';
|
|
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
|
|
process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
|
|
};
|
|
style-src 'self' 'unsafe-eval' 'unsafe-inline';
|
|
img-src 'self' 'unsafe-inline' https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com blob: data:;
|
|
connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
|
|
font-src 'self' https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
|
|
object-src 'none';
|
|
base-uri 'self';
|
|
form-action 'self' ` +
|
|
process.env.NEXTAUTH_URL +
|
|
`;
|
|
frame-ancestors 'none';
|
|
upgrade-insecure-requests;
|
|
`;
|
|
|
|
// csp += `base-uri 'self';`;
|
|
// csp += `script-src 'self' 'unsafe-eval' 'unsafe-inline' https://ukwest-0.in.applicationinsights.azure.com https://region1.google-analytics.com https://www.google-analytics.com/ https://tagmanager.google.com/ https://www.googletagmanager.com/;`;
|
|
// csp += `style-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://www.google-analytics.com https://tagmanager.google.com/ https://www.googletagmanager.com/ https://fonts.googleapis.com/;`;
|
|
// csp += `img-src 'self' 'unsafe-inline' https://maps.gstatic.com https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://ssl.gstatic.com/ blob: data:;`;
|
|
// csp += `connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;`;
|
|
|
|
// csp += `form-action 'self' ` + process.env.NEXTAUTH_URL + ` ;`;
|
|
// csp += `object-src 'self' data:;`;
|
|
// csp += `default-src 'self' https://www.google-analytics.com;`;
|
|
|
|
// csp += `font-src 'self' 'unsafe-inline' https://pro.fontawesome.com/ https://fonts.gstatic.com/ data:;`;
|
|
// csp += `frame-src https://datamap.gov.wales`;
|
|
|
|
// Replace newline characters and spaces
|
|
const contentSecurityPolicyHeaderValue = cspHeader
|
|
.replace(/\s{2,}/g, " ")
|
|
.trim();
|
|
|
|
const requestHeaders = new Headers(request.headers);
|
|
requestHeaders.set("x-nonce", nonce);
|
|
requestHeaders.set(
|
|
"Content-Security-Policy",
|
|
contentSecurityPolicyHeaderValue
|
|
);
|
|
|
|
const response = NextResponse.next({
|
|
request: {
|
|
headers: requestHeaders,
|
|
},
|
|
});
|
|
response.headers.set(
|
|
"Content-Security-Policy",
|
|
contentSecurityPolicyHeaderValue
|
|
);
|
|
|
|
return response;
|
|
}
|
|
|
|
// export const config = {
|
|
// matcher: [
|
|
// /*
|
|
// * Match all request paths except for the ones starting with:
|
|
// * - api (API routes)
|
|
// * - _next/static (static files)
|
|
// * - _next/image (image optimization files)
|
|
// * - favicon.ico (favicon file)
|
|
// */
|
|
// {
|
|
// source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
|
|
// missing: [
|
|
// { type: "header", key: "next-router-prefetch" },
|
|
// { type: "header", key: "purpose", value: "prefetch" },
|
|
// ],
|
|
// },
|
|
// ],
|
|
// };
|