Next JS Content Security Policy (CSP) #31402
-
|
Hello, I am currently making a Content Security Policy (CSP) for a production application made with Next.js. While I have found trustworthy documentation for implementing a CSP with the framework, there are a couple of concerns that I want to make sure are addressed correctly. Issue 1: I have read that security policies set in HTTP headers are preferable. However, I cannot find a way to pass a 'nonce' attribute for inline styles in production using this approach. Issue 2: I've seen other examples where developers inject their CSP in the custom document("./pages/_document.js"). I am hesitant to use this approach because I hear meta-tag CSPs are easily bypassable. https://github.com/vercel/next.js/tree/canary/examples/with-strict-csp My Questions:
All the best, |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments
-
|
yeah i have related issue. can someone or we need example for ex: bcz i still got wrong character on console browser |
Beta Was this translation helpful? Give feedback.
-
There is a project called The most clarifying sources I found are those: According to this There is this example: https://github.com/vercel/next.js/blob/canary/examples/with-strict-csp. However, if you add Edit: I made a package @next-safe/middleware that provides strict-dynamic support for hybrid Next.js apps (Nonce-based for pages with |
Beta Was this translation helpful? Give feedback.
-
|
@SamuelColeMorgan did you find any solution to use nonce in "next.config.js" |
Beta Was this translation helpful? Give feedback.
-
|
Hey folks, wanted to swing back here with an update. After digging through many different issues and discussions, I've made a new page in the documentation (PR) specifically for Content Security Policy and nonces. This docs page:
Further, we've patched some bugs and made improvements to Really hope this helps out, thank you all 🙏 I'll be closing this discussion out. To continue the discussion, please go here. |
Beta Was this translation helpful? Give feedback.
Hey folks, wanted to swing back here with an update. After digging through many different issues and discussions, I've made a new page in the documentation (PR) specifically for Content Security Policy and nonces. This docs page:
noncewith Middlewarenoncein a route withheaders()unsafenonceMiddleware from running on prefetches / static assetsFurther, we've patched some bugs and made improvements to
noncehandling in Next.js that will be available in the latestcanaryversion (for those of you time traveling from the future, upgrade to Next.js 13.5). We also …