spb/sp-calendar

1import type { NextConfig } from "next";23// Static CSP: Next's inline bootstrap scripts need 'unsafe-inline' unless every page is rendered with a nonce.4// No third-party origin is allowed anywhere; no upgrade-insecure-requests (breaks WebKit on http://127.0.0.1 in tests).5const csp = [6  "default-src 'self'",7  // React's development build needs eval for its debugging features; production never gets it.8  `script-src 'self' 'unsafe-inline'${process.env.NODE_ENV === "production" ? "" : " 'unsafe-eval'"}`,9  "style-src 'self' 'unsafe-inline'",10  "img-src 'self' data: blob:",11  "font-src 'self'",12  "connect-src 'self'",13  "frame-ancestors 'none'",14  "base-uri 'self'",15  "form-action 'self'",16  "object-src 'none'",17].join("; ");1819const config: NextConfig = {20  poweredByHeader: false,21  serverExternalPackages: ["postgres", "nodemailer"],22  async headers() {23    return [24      {25        source: "/:path*",26        headers: [27          { key: "Content-Security-Policy", value: csp },28          { key: "X-Content-Type-Options", value: "nosniff" },29          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },30          { key: "X-Frame-Options", value: "DENY" },31          { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), interest-cohort=()" },32          { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },33        ],34      },35    ];36  },37};38export default config;39