vacp2p/linea-monorepo
1
0
Fork 0
mirror of https://github.com/vacp2p/linea-monorepo.git synced 2026-01-08 03:43:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix: update csp headers in bridge ui (#1187)

Browse Source 
* fix: update csp headers in bridge ui

* fix: update csp headers in bridge ui
This commit is contained in:
Victorien Gauch
2025-06-18 17:25:48 +02:00
committed by GitHub
parent cfa69b8146
commit 7431c91ca2
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
bridge-ui/src/middleware.ts
View File

@@ -7,7 +7,7 @@ export function middleware(request: NextRequest) {
// We only want to allow unsafe-eval in local environment for NextJS dev server // We only want to allow unsafe-eval in local environment for NextJS dev server
// We are required to use unsafe-inline with Cloudflare - https://developers.cloudflare.com/fundamentals/reference/policies-compliances/content-security-policies/#product-requirements // We are required to use unsafe-inline with Cloudflare - https://developers.cloudflare.com/fundamentals/reference/policies-compliances/content-security-policies/#product-requirements
// TODO: Remove unsafe-eval in production and replace with 'unsafe-inline' // TODO: Remove unsafe-eval in production and replace with 'unsafe-inline'
const unsafeScript = process.env.NEXT_PUBLIC_ENVIRONMENT === "local" ? "'unsafe-eval'" : "'unsafe-eval'"; // const unsafeScript = process.env.NEXT_PUBLIC_ENVIRONMENT === "local" ? "'unsafe-eval'" : "'unsafe-eval'";
/** /**
* Content Security Policy (CSP) configuration: * Content Security Policy (CSP) configuration:
@@ -54,8 +54,7 @@ export function middleware(request: NextRequest) {
*/ */
const cspHeader = ` const cspHeader = `
default-src 'self'; default-src 'self';
script-src 'self' 'nonce-${nonce}' ${unsafeScript} https://bridge.linea.build https://bridge-devnet.linea.build script-src 'self' 'nonce-${nonce}' https://www.googletagmanager.com/gtm.js https://widget.intercom.io/widget/h5zisg78 https://ajax.cloudflare.com https://js.intercomcdn.com;
https://www.googletagmanager.com/gtm.js https://widget.intercom.io/widget/h5zisg78;
style-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';
img-src 'self' blob: data: https:; img-src 'self' blob: data: https:;
font-src 'self' data: https://cdn.jsdelivr.net; font-src 'self' data: https://cdn.jsdelivr.net;