feat(dcellar-web-ui): add csp

node-real · Nov 5, 2024 · bc412dc · bc412dc
1 parent fff19a1
commit bc412dc
Show file tree

Hide file tree

Showing 3 changed files with 65 additions and 2 deletions.
diff --git a/apps/dcellar-web-ui/src/base/env.ts b/apps/dcellar-web-ui/src/base/env.ts
@@ -1,7 +1,7 @@
 import { removeTrailingSlash } from '@/utils/string';
 import getConfig from 'next/config';
 
-const { publicRuntimeConfig, serverRuntimeConfig } = getConfig();
+const { publicRuntimeConfig, serverRuntimeConfig } = getConfig() || {};
 const {
   NEXT_PUBLIC_ENV,
   NEXT_PUBLIC_STATIC_HOST,

diff --git a/apps/dcellar-web-ui/src/middleware.ts b/apps/dcellar-web-ui/src/middleware.ts
@@ -0,0 +1,56 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+export function middleware(request: NextRequest) {
+  const cspHeader = `
+    default-src 'self';
+    script-src 'self' 'unsafe-eval' https: https://www.googletagmanager.com https://www.google-analytics.com https://analytics.google.com;
+    script-src-elem 'self' 'unsafe-inline' https: https://www.googletagmanager.com https://www.google-analytics.com https://analytics.google.com;
+    style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
+    img-src 'self' blob: data: https: https://www.google-analytics.com https://www.googletagmanager.com;
+    font-src 'self' https://fonts.gstatic.com;
+    connect-src *;
+    object-src 'none';
+    base-uri 'self';
+    form-action 'self';
+    frame-ancestors 'none';
+    frame-src 'self' https://*.walletconnect.com https://verify.walletconnect.com;
+    media-src 'self';
+    manifest-src 'self';
+    worker-src 'self' blob:;
+    upgrade-insecure-requests;
+`;
+
+  const cleanCspHeader = cspHeader.replace(/\s+/g, ' ').trim();
+
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set('Content-Security-Policy', cleanCspHeader);
+
+  const response = NextResponse.next({
+    request: {
+      headers: requestHeaders,
+    },
+  });
+
+  response.headers.set('Content-Security-Policy', cleanCspHeader);
+
+  return response;
+}
+
+export const config = {
+  matcher: [
+    /*
+     * Match all request paths except for the ones starting with:
+     * - api (API routes)
+     * - _next/static (static files)
+     * - _next/image (image optimization files)
+     * - favicon.ico (favicon file)
+     */
+    {
+      source: '/((?!api|_next/static|_next/image|favicon.ico).*)',
+      missing: [
+        { type: 'header', key: 'next-router-prefetch' },
+        { type: 'header', key: 'purpose', value: 'prefetch' },
+      ],
+    },
+  ],
+};
diff --git a/apps/dcellar-web-ui/src/pages/_document.tsx b/apps/dcellar-web-ui/src/pages/_document.tsx
@@ -6,8 +6,15 @@ import * as flatted from 'flatted';
 
 export default function Document() {
   return (
-    <Html lang="en" style={{ colorScheme: 'light' }} data-theme="light">
+    <Html lang="en" className="light-theme" data-theme="light">
       <Head>
+        <style>
+          {`
+            .light-theme {
+              color-scheme: light;
+            }
+          `}
+        </style>
         <meta
           name="google-site-verification"
           content="9P1xIkjIzkjS3UiiTBjcjN5tfyh4Yk6FDKELgtTdMGE"