maro/anouma
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow Next hydration scripts under CSP

Browse Source
This commit is contained in:
maro
2026-09-16 22:11:23 +02:00
parent ab83a32d7b
commit 69f2653563
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
next.config.ts
+6 -6
View File
@@ -25,15 +25,15 @@ const baseSecurityHeaders = [
// so a content policy doesn't apply to them anyway. connect-src stays broad // so a content policy doesn't apply to them anyway. connect-src stays broad
// because the WebRTC call pages connect to the separately hosted LiveKit SFU // because the WebRTC call pages connect to the separately hosted LiveKit SFU
// at runtime. style-src needs // at runtime. style-src needs
// 'unsafe-inline' because framer-motion drives its animations through // 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap
// inline style attributes. script-src allows 'unsafe-eval' only in dev, // scripts that are required for hydration. script-src allows 'unsafe-eval'
// matching Next's own documented CSP guidance — React uses eval there for // only in dev, matching Next's own documented CSP guidance — React uses eval
// server-error-stack reconstruction; neither React nor Next use it in a // there for server-error-stack reconstruction; neither React nor Next use it
// production build. // in a production build.
const isDev = process.env.NODE_ENV === "development"; const isDev = process.env.NODE_ENV === "development";
const frontendCSP = [ const frontendCSP = [
"default-src 'self'", "default-src 'self'",
`script-src 'self'${isDev ? " 'unsafe-eval'" : ""}`, `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
"style-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'",
"img-src 'self' data: blob:", "img-src 'self' data: blob:",
"font-src 'self' data:", "font-src 'self' data:",