maro/anouma
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow Turnstile in frontend CSP

Browse Source
This commit is contained in:
maro
2026-09-18 01:27:07 +02:00
parent b29862b4b7
commit d7576cb925
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
next.config.ts
+5 -5
View File
@@ -22,9 +22,8 @@ const baseSecurityHeaders = [
// Deliberately NOT applied to /admin or /api: Payload's admin bundle isn't // Deliberately NOT applied to /admin or /api: Payload's admin bundle isn't
// audited here for CSP compatibility, and API routes serve data, not HTML, // audited here for CSP compatibility, and API routes serve data, not HTML,
// so a content policy doesn't apply to them anyway. connect-src stays broad // so a content policy doesn't apply to them anyway. connect-src permits the
// because the WebRTC call pages connect to the separately hosted LiveKit SFU // separately hosted LiveKit SFU and Cloudflare Turnstile at runtime. style-src needs
// at runtime. style-src needs
// 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap // 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap
// scripts that are required for hydration. script-src allows 'unsafe-eval' // scripts that are required for hydration. script-src allows 'unsafe-eval'
// only in dev, matching Next's own documented CSP guidance - React uses eval // only in dev, matching Next's own documented CSP guidance - React uses eval
@@ -33,12 +32,13 @@ const baseSecurityHeaders = [
const isDev = process.env.NODE_ENV === "development"; const isDev = process.env.NODE_ENV === "development";
const frontendCSP = [ const frontendCSP = [
"default-src 'self'", "default-src 'self'",
`script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`, `script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com${isDev ? " 'unsafe-eval'" : ""}`,
"style-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'",
"img-src 'self' data: blob:", "img-src 'self' data: blob:",
"font-src 'self' data:", "font-src 'self' data:",
"connect-src 'self' https: wss: stun: turn: turns:", "connect-src 'self' https://challenges.cloudflare.com wss: stun: turn: turns:",
"media-src 'self' blob:", "media-src 'self' blob:",
"frame-src 'self' https://challenges.cloudflare.com",
"frame-ancestors 'self'", "frame-ancestors 'self'",
"base-uri 'self'", "base-uri 'self'",
"form-action 'self'", "form-action 'self'",