archive/rsnext
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update 15-content-security-policy.mdx

Browse source 
Ensures the CSP header is still set on the response.
This commit is contained in:
Tim Neutkens 2023-11-10 14:28:43 +01:00 committed by GitHub
parent 20ad9ac270
commit af2c3f71bf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
docs/02-app/01-building-your-application/07-configuring/15-content-security-policy.mdx
View file

@ -54,20 +54,31 @@ export function middleware(request: NextRequest) {
block-all-mixed-content;
upgrade-insecure-requests;
`
// Replace newline characters and spaces
const contentSecurityPolicyHeaderValue = cspHeader
.replace(/\s{2,}/g, ' ')
.trim()
const requestHeaders = new Headers(request.headers)
requestHeaders.set('x-nonce', nonce)
requestHeaders.set(
'Content-Security-Policy',
// Replace newline characters and spaces
cspHeader.replace(/\s{2,}/g, ' ').trim()
contentSecurityPolicyHeaderValue
)
return NextResponse.next({
const response = NextResponse.next({
headers: requestHeaders,
request: {
headers: requestHeaders,
},
})
response.headers.set(
'Content-Security-Policy',
contentSecurityPolicyHeaderValue
)
return response
}
```
@ -89,21 +100,30 @@ export function middleware(request) {
block-all-mixed-content;
upgrade-insecure-requests;
`
// Replace newline characters and spaces
const contentSecurityPolicyHeaderValue = cspHeader
.replace(/\s{2,}/g, ' ')
.trim()
const requestHeaders = new Headers(request.headers)
requestHeaders.set('x-nonce', nonce)
requestHeaders.set(
'Content-Security-Policy',
// Replace newline characters and spaces
cspHeader.replace(/\s{2,}/g, ' ').trim()
contentSecurityPolicyHeaderValue
)
return NextResponse.next({
const response = NextResponse.next({
headers: requestHeaders,
request: {
headers: requestHeaders,
},
})
response.headers.set(
'Content-Security-Policy',
contentSecurityPolicyHeaderValue
)
return response
}
```