70 lines
2.1 KiB
TypeScript
70 lines
2.1 KiB
TypeScript
import { type NextRequest, NextResponse } from "next/server";
|
|
import createIntlMiddleware from "next-intl/middleware";
|
|
import { routing } from "./i18n/routing";
|
|
|
|
const intlMiddleware = createIntlMiddleware(routing);
|
|
|
|
export function proxy(request: NextRequest) {
|
|
const nonce = crypto.randomUUID();
|
|
const isDev = process.env.NODE_ENV === "development";
|
|
|
|
const scriptSrc = isDev
|
|
? `'self' 'nonce-${nonce}' 'unsafe-eval'`
|
|
: `'self' 'nonce-${nonce}'`;
|
|
|
|
const connectSrc = isDev ? `'self' https: ws: wss:` : `'self' https:`;
|
|
|
|
const frameAncestors = process.env.ALLOWED_FRAME_ANCESTORS?.trim() || "'none'";
|
|
|
|
const csp = [
|
|
`default-src 'self'`,
|
|
`script-src ${scriptSrc}`,
|
|
`style-src 'self' 'unsafe-inline'`,
|
|
`img-src 'self' data: https:`,
|
|
`font-src 'self'`,
|
|
`connect-src ${connectSrc}`,
|
|
`frame-src 'none'`,
|
|
`object-src 'none'`,
|
|
`base-uri 'self'`,
|
|
`form-action 'self'`,
|
|
`frame-ancestors ${frameAncestors}`,
|
|
].join("; ");
|
|
|
|
let intlResponse: ReturnType<typeof intlMiddleware> | null = null;
|
|
try {
|
|
intlResponse = intlMiddleware(request);
|
|
} catch (error) {
|
|
console.error('Locale middleware error:', error);
|
|
}
|
|
const response = intlResponse ?? NextResponse.next();
|
|
|
|
const existing = response.headers.get("x-middleware-override-headers");
|
|
response.headers.set(
|
|
"x-middleware-override-headers",
|
|
existing ? `${existing},x-nonce` : "x-nonce"
|
|
);
|
|
response.headers.set("x-middleware-request-x-nonce", nonce);
|
|
|
|
response.headers.set("X-Content-Type-Options", "nosniff");
|
|
|
|
// X-Frame-Options only supports DENY/SAMEORIGIN. When frame-ancestors
|
|
// specifies explicit origins, we rely solely on the CSP header.
|
|
if (frameAncestors === "'none'") {
|
|
response.headers.set("X-Frame-Options", "DENY");
|
|
}
|
|
|
|
response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
|
|
response.headers.set("X-XSS-Protection", "0");
|
|
response.headers.set(
|
|
"Permissions-Policy",
|
|
"camera=(), microphone=(), geolocation=(), payment=()"
|
|
);
|
|
response.headers.set("Content-Security-Policy-Report-Only", csp);
|
|
|
|
return response;
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!api|_next|.*\\..*).*)"],
|
|
};
|