zhangxiang
a995f40eae
- Add Content-Security-Policy and Permissions-Policy headers to nginx config - Add same headers to next.config.mjs for dev/preview mode - Add Referrer-Policy to next.config.mjs (was only in nginx) - Generate production JWT/CMS secrets via openssl rand -base64 64 - Update README mark production env/security header task as complete
44 lines
1.5 KiB
JavaScript
44 lines
1.5 KiB
JavaScript
const cdnDomain = process.env.CDN_DOMAIN || '';
|
|
|
|
const nextConfig = {
|
|
distDir: 'dist',
|
|
assetPrefix: cdnDomain || undefined,
|
|
images: {
|
|
unoptimized: true,
|
|
formats: ['image/avif', 'image/webp'],
|
|
},
|
|
compress: true,
|
|
poweredByHeader: false,
|
|
reactStrictMode: true,
|
|
experimental: {
|
|
optimizePackageImports: ['lucide-react', 'framer-motion'],
|
|
},
|
|
compiler: {
|
|
removeConsole: process.env.NODE_ENV === 'production',
|
|
},
|
|
generateEtags: true,
|
|
httpAgentOptions: {
|
|
keepAlive: true,
|
|
},
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: '/(.*)',
|
|
headers: [
|
|
{ key: 'X-Content-Type-Options', value: 'nosniff' },
|
|
{ key: 'X-Frame-Options', value: 'DENY' },
|
|
{ key: 'X-XSS-Protection', value: '1; mode=block' },
|
|
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
|
|
{
|
|
key: 'Content-Security-Policy',
|
|
value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://ssl.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://ssl.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';",
|
|
},
|
|
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
|
|
],
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|