Matthieu MALVACHEandMatthieu MALVACHE
fb414bf2c9
- Contact groups/lists, vCard import/export (RFC 6350), bulk operations - Advanced search with JMAP filter panel, search chips, cross-mailbox queries - Vacation responder with JMAP VacationResponse, settings tab, sidebar indicator - TOTP two-factor authentication support - Docker multi-stage build with standalone output and docker-compose - CSP Report-Only headers and security headers via proxy middleware - Virtual scrolling for large email lists - Structured server-side logger (text/JSON, configurable level) - 450+ tests (contacts, vCard, threads, headers, identity, components) - Playwright E2E framework setup - Updated README and ROADMAP with all new features
62 lines
1.9 KiB
TypeScript
62 lines
1.9 KiB
TypeScript
import { type NextRequest, NextResponse } from "next/server";
|
|
import createIntlMiddleware from "next-intl/middleware";
|
|
import { routing } from "./i18n/routing";
|
|
|
|
const intlMiddleware = createIntlMiddleware(routing);
|
|
|
|
export function proxy(request: NextRequest) {
|
|
const nonce = crypto.randomUUID();
|
|
const isDev = process.env.NODE_ENV === "development";
|
|
|
|
const scriptSrc = isDev
|
|
? `'self' 'nonce-${nonce}' 'unsafe-eval'`
|
|
: `'self' 'nonce-${nonce}'`;
|
|
|
|
const connectSrc = isDev ? `'self' https: ws: wss:` : `'self' https:`;
|
|
|
|
const csp = [
|
|
`default-src 'self'`,
|
|
`script-src ${scriptSrc}`,
|
|
`style-src 'self' 'unsafe-inline'`,
|
|
`img-src 'self' data: https:`,
|
|
`font-src 'self'`,
|
|
`connect-src ${connectSrc}`,
|
|
`frame-src 'none'`,
|
|
`object-src 'none'`,
|
|
`base-uri 'self'`,
|
|
`form-action 'self'`,
|
|
`frame-ancestors 'none'`,
|
|
].join("; ");
|
|
|
|
let intlResponse: ReturnType<typeof intlMiddleware> | null = null;
|
|
try {
|
|
intlResponse = intlMiddleware(request);
|
|
} catch (error) {
|
|
console.error('Locale middleware error:', error);
|
|
}
|
|
const response = intlResponse ?? NextResponse.next();
|
|
|
|
const existing = response.headers.get("x-middleware-override-headers");
|
|
response.headers.set(
|
|
"x-middleware-override-headers",
|
|
existing ? `${existing},x-nonce` : "x-nonce"
|
|
);
|
|
response.headers.set("x-middleware-request-x-nonce", nonce);
|
|
|
|
response.headers.set("X-Content-Type-Options", "nosniff");
|
|
response.headers.set("X-Frame-Options", "DENY");
|
|
response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
|
|
response.headers.set("X-XSS-Protection", "0");
|
|
response.headers.set(
|
|
"Permissions-Policy",
|
|
"camera=(), microphone=(), geolocation=(), payment=()"
|
|
);
|
|
response.headers.set("Content-Security-Policy-Report-Only", csp);
|
|
|
|
return response;
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!api|_next|.*\\..*).*)"],
|
|
};
|