zhangxiang
30924a2887
Align Next.js response CSP with Nginx so GTM conversion pixels are not blocked by the intersection of duplicate CSP headers.
45 lines
1.6 KiB
JavaScript
45 lines
1.6 KiB
JavaScript
const cdnDomain = process.env.CDN_DOMAIN || '';
|
|
|
|
const nextConfig = {
|
|
output: 'standalone',
|
|
distDir: 'dist',
|
|
assetPrefix: cdnDomain || undefined,
|
|
images: {
|
|
unoptimized: true,
|
|
formats: ['image/avif', 'image/webp'],
|
|
},
|
|
compress: true,
|
|
poweredByHeader: false,
|
|
reactStrictMode: true,
|
|
experimental: {
|
|
optimizePackageImports: ['lucide-react', 'framer-motion'],
|
|
},
|
|
compiler: {
|
|
removeConsole: process.env.NODE_ENV === 'production',
|
|
},
|
|
generateEtags: true,
|
|
httpAgentOptions: {
|
|
keepAlive: true,
|
|
},
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: '/(.*)',
|
|
headers: [
|
|
{ key: 'X-Content-Type-Options', value: 'nosniff' },
|
|
{ key: 'X-Frame-Options', value: 'DENY' },
|
|
{ key: 'X-XSS-Protection', value: '1; mode=block' },
|
|
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
|
|
{
|
|
key: 'Content-Security-Policy',
|
|
value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://ssl.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';",
|
|
},
|
|
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
|
|
],
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|