Skip to content

Commit 9065659

Browse files
lwwmanningclaude
andauthored
Tighten CSP (object-src) and Permissions-Policy; allow Vercel Analytics origin (#58)
* Tighten CSP (object-src) and Permissions-Policy; allow Vercel Analytics origin Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Allow Vercel Live origins for preview deploys Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> --------- Signed-off-by: Will Manning <will@willmanning.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent b6a14d0 commit 9065659

1 file changed

Lines changed: 16 additions & 7 deletions

File tree

next.config.mjs

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,18 +12,26 @@ if (!process.env.VELITE_STARTED && (isDev || isBuild)) {
1212
// MDXRenderer compiles velite-emitted JSX via `new Function(code)`, but it's
1313
// a server component — the eval happens at build/SSR time on the server, so
1414
// the browser never sees the dynamic code and CSP doesn't need 'unsafe-eval'.
15+
//
16+
// vercel.live (+ vercel.com / assets.vercel.com / wss://ws-us3.pusher.com) is
17+
// the Vercel Live feedback toolbar, injected on preview deploys only. It's
18+
// not loaded in production, so widening these directives doesn't broaden the
19+
// prod attack surface — and a single static CSP is simpler than swapping
20+
// headers per environment.
1521
const csp = [
1622
"default-src 'self'",
17-
"script-src 'self' 'unsafe-inline' plausible.io",
18-
"style-src 'self' 'unsafe-inline'",
19-
"img-src 'self' data: blob:",
20-
"font-src 'self' data:",
21-
"connect-src 'self' plausible.io vitals.vercel-insights.com",
23+
"script-src 'self' 'unsafe-inline' plausible.io va.vercel-scripts.com vercel.live",
24+
"style-src 'self' 'unsafe-inline' vercel.live",
25+
"img-src 'self' data: blob: vercel.live vercel.com",
26+
"font-src 'self' data: vercel.live assets.vercel.com",
27+
"connect-src 'self' plausible.io vitals.vercel-insights.com vercel.live wss://ws-us3.pusher.com",
2228
"worker-src 'self' blob:",
2329
"child-src 'self' blob:",
30+
"frame-src 'self' vercel.live",
2431
"frame-ancestors 'none'",
2532
"base-uri 'self'",
26-
"form-action 'self'"
33+
"form-action 'self'",
34+
"object-src 'none'"
2735
].join("; ");
2836

2937
// next-plausible v4 requires a `src` URL for the v2 Plausible script. When
@@ -58,7 +66,8 @@ const nextConfig = wrapWithPlausible({
5866
},
5967
{
6068
key: "Permissions-Policy",
61-
value: "camera=(), microphone=(), geolocation=(), payment=()"
69+
value:
70+
"camera=(), microphone=(), geolocation=(), gyroscope=(), payment=(), usb=(), magnetometer=(), accelerometer=()"
6271
},
6372
{ key: "Content-Security-Policy", value: csp }
6473
]

0 commit comments

Comments
 (0)