3370022ac2
in #54059 the nonce attribute was added to preinitialized scripts to when using this CSP directive. The test added asserts there is at least one script that has the nonce attribute. I've changed this to 2 because currently our builds produce at least two "main" scripts, the main chunk and the webpack runtime. The way we bootstrap there is always exactly one bootstrap script which means if we only assert that there is one script with a nonce we might not be asserting anything about the preinit script path. If we ever update our webpack config to produce a single main script this test will fail but we should never do that (it's bad for caching) and so it shouldn't happen and if it does it will hopefully force us to consider if we're making a mistake Additionally I've added another test that is more e2e. it asserts that the page bootstraps even when using CSP (in prod). In Dev it asserts the CSP attributes but it expects the bootstrap to fail because our dev mode violates the CSP directive with eval.
71 lines
2.1 KiB
JavaScript
71 lines
2.1 KiB
JavaScript
// @ts-check
|
|
import { NextResponse } from 'next/server'
|
|
|
|
/**
|
|
* @param {import('next/server').NextRequest} request
|
|
* @returns {Promise<NextResponse | undefined>}
|
|
*/
|
|
export async function middleware(request) {
|
|
if (request.nextUrl.pathname === '/searchparams-normalization-bug') {
|
|
const headers = new Headers(request.headers)
|
|
headers.set('test', request.nextUrl.searchParams.get('val') || '')
|
|
const response = NextResponse.next({
|
|
request: {
|
|
headers,
|
|
},
|
|
})
|
|
|
|
return response
|
|
}
|
|
if (request.nextUrl.pathname === '/exists-but-not-routed') {
|
|
return NextResponse.rewrite(new URL('/dashboard', request.url))
|
|
}
|
|
|
|
if (request.nextUrl.pathname === '/middleware-to-dashboard') {
|
|
return NextResponse.rewrite(new URL('/dashboard', request.url))
|
|
}
|
|
|
|
// In dev this route will fail to bootstrap because webpack uses eval which is dissallowed by
|
|
// this policy. In production this route will work
|
|
if (request.nextUrl.pathname === '/bootstrap/with-nonce') {
|
|
const nonce = crypto.randomUUID()
|
|
return NextResponse.next({
|
|
headers: {
|
|
'Content-Security-Policy': `script-src 'nonce-${nonce}' 'strict-dynamic';`,
|
|
},
|
|
})
|
|
}
|
|
|
|
if (request.nextUrl.pathname.startsWith('/internal/test')) {
|
|
const method = request.nextUrl.pathname.endsWith('rewrite')
|
|
? 'rewrite'
|
|
: 'redirect'
|
|
|
|
const internal = ['RSC', 'Next-Router-State-Tree']
|
|
if (internal.some((name) => request.headers.has(name.toLowerCase()))) {
|
|
return NextResponse[method](new URL('/internal/failure', request.url))
|
|
}
|
|
|
|
return NextResponse[method](new URL('/internal/success', request.url))
|
|
}
|
|
|
|
if (request.nextUrl.pathname === '/search-params-prop-middleware-rewrite') {
|
|
return NextResponse.rewrite(
|
|
new URL(
|
|
'/search-params-prop?first=value&second=other%20value&third',
|
|
request.url
|
|
)
|
|
)
|
|
}
|
|
|
|
if (
|
|
request.nextUrl.pathname === '/search-params-prop-server-middleware-rewrite'
|
|
) {
|
|
return NextResponse.rewrite(
|
|
new URL(
|
|
'/search-params-prop/server?first=value&second=other%20value&third',
|
|
request.url
|
|
)
|
|
)
|
|
}
|
|
}
|