perf: make root HTML cacheable by dropping per-request CSP nonce

2026-04-18 13:01:12 +02:00
parent 1689315c3a
commit 522bf6a019
6 changed files with 17 additions and 42 deletions
@@ -180,7 +180,7 @@ Built with Next.js and the JMAP protocol.
 - **TOTP two-factor authentication**
 - **Account security panel** - manage passwords and 2FA via Stalwart admin API
 - **"Remember me"** - AES-256-GCM encrypted httpOnly cookie (opt-in)
- **Security headers** - enforced CSP with per-request nonce, X-Frame-Options, Referrer-Policy; SSRF redirect validation; PDF iframe sandbox; IP spoofing prevention
+- **Security headers** - enforced CSP (script-src 'self', no unsafe-inline), X-Frame-Options, Referrer-Policy; SSRF redirect validation; PDF iframe sandbox; IP spoofing prevention
 - **Plugin hardening** - dangerous-pattern detection, admin approval required, secure HTTP proxy API (no auth-header exposure)
 - **Newsletter unsubscribe** (RFC 2369)

@@ -18,15 +18,8 @@ export default async function LocaleLayout({

  if (!(locales as readonly string[]).includes(locale)) notFound();

-  let messages;
-  try {
-    messages = (await import(`@/locales/${locale}/common.json`)).default;
-  } catch {
-    notFound();
-  }
-
  return (
-    <IntlProvider locale={locale} messages={messages}>
+    <IntlProvider locale={locale}>
      <ThemeProvider>
        <CalendarAlertProvider>
          <RateLimitToastProvider>
@@ -1,6 +1,5 @@
 import type { Metadata } from "next";
 import { Geist, Geist_Mono } from "next/font/google";
-import { headers } from "next/headers";
 import { getLocale } from "next-intl/server";
 import { PWAInstallPrompt } from "@/components/pwa-install-prompt";
 import { ServiceWorkerRegistration } from "@/components/service-worker-registration";
@@ -40,7 +39,6 @@ export default async function RootLayout({
  children: React.ReactNode;
 }) {
  const locale = await getLocale();
-  const nonce = (await headers()).get("x-nonce") ?? "";
  const parentOrigin = process.env.NEXT_PUBLIC_PARENT_ORIGIN || "";

  return (
@@ -57,26 +55,7 @@ export default async function RootLayout({
        {parentOrigin && (
          <meta name="parent-origin" content={parentOrigin} />
        )}
-        <script
-          nonce={nonce}
-          suppressHydrationWarning
-          dangerouslySetInnerHTML={{
-            __html: `
-              (function() {
-                try {
-                  const stored = localStorage.getItem('theme-storage');
-                  const theme = stored ? JSON.parse(stored).state.theme : 'system';
-                  const systemTheme = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
-                  const resolved = theme === 'system' ? systemTheme : theme;
-                  document.documentElement.classList.remove('light', 'dark');
-                  document.documentElement.classList.add(resolved);
-                } catch (e) {
-                  document.documentElement.classList.add('light');
-                }
-              })();
-            `,
-          }}
-        />
+        <script src="/theme-init.js" />
      </head>
      <body
        className={`${geistSans.variable} ${geistMono.variable} antialiased`}
@@ -38,7 +38,6 @@ const ALL_MESSAGES = {

 interface IntlProviderProps {
  locale: string;
-  messages: Record<string, unknown>;
  children: React.ReactNode;
 }

@@ -5,12 +5,11 @@ import { routing } from "./i18n/routing";
 const intlMiddleware = createIntlMiddleware(routing);

 export function proxy(request: NextRequest) {
-  const nonce = crypto.randomUUID();
  const isDev = process.env.NODE_ENV === "development";

  const scriptSrc = isDev
-    ? `'self' 'nonce-${nonce}' 'unsafe-eval' blob:`
-    : `'self' 'nonce-${nonce}' blob:`;
+    ? `'self' 'unsafe-eval' blob:`
+    : `'self' blob:`;

  const connectSrc = isDev ? `'self' https: ws: wss:` : `'self' https:`;

@@ -52,13 +51,6 @@ export function proxy(request: NextRequest) {
  }
  const response = intlResponse ?? NextResponse.next();

-  const existing = response.headers.get("x-middleware-override-headers");
-  response.headers.set(
-    "x-middleware-override-headers",
-    existing ? `${existing},x-nonce` : "x-nonce"
-  );
-  response.headers.set("x-middleware-request-x-nonce", nonce);
-
  response.headers.set("X-Content-Type-Options", "nosniff");

  // X-Frame-Options only supports DENY/SAMEORIGIN. When frame-ancestors
@@ -0,0 +1,12 @@
+(function () {
+  try {
+    var stored = localStorage.getItem('theme-storage');
+    var theme = stored ? JSON.parse(stored).state.theme : 'system';
+    var systemTheme = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+    var resolved = theme === 'system' ? systemTheme : theme;
+    document.documentElement.classList.remove('light', 'dark');
+    document.documentElement.classList.add(resolved);
+  } catch (e) {
+    document.documentElement.classList.add('light');
+  }
+})();