From 69f26535636166d5b6bb3bcd581d5ac262b22fe9 Mon Sep 17 00:00:00 2001 From: maro Date: Wed, 16 Sep 2026 22:11:23 +0200 Subject: [PATCH] fix: allow Next hydration scripts under CSP --- next.config.ts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/next.config.ts b/next.config.ts index 5097885..f946d9d 100644 --- a/next.config.ts +++ b/next.config.ts @@ -25,15 +25,15 @@ const baseSecurityHeaders = [ // so a content policy doesn't apply to them anyway. connect-src stays broad // because the WebRTC call pages connect to the separately hosted LiveKit SFU // at runtime. style-src needs -// 'unsafe-inline' because framer-motion drives its animations through -// inline style attributes. script-src allows 'unsafe-eval' only in dev, -// matching Next's own documented CSP guidance — React uses eval there for -// server-error-stack reconstruction; neither React nor Next use it in a -// production build. +// 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap +// scripts that are required for hydration. script-src allows 'unsafe-eval' +// only in dev, matching Next's own documented CSP guidance — React uses eval +// there for server-error-stack reconstruction; neither React nor Next use it +// in a production build. const isDev = process.env.NODE_ENV === "development"; const frontendCSP = [ "default-src 'self'", - `script-src 'self'${isDev ? " 'unsafe-eval'" : ""}`, + `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`, "style-src 'self' 'unsafe-inline'", "img-src 'self' data: blob:", "font-src 'self' data:",