Danijel Martinek
5fd483af39
- Add @tanstack/start + vinxi to deps so defineConfig is available - Uncomment defineConfig registration in app.config.ts — middleware is now actually wired into the Nitro server hook, not just defined - Update __root.tsx loader to call getNonce(getEvent().node.req) from @repo/core-shared/security/tanstack so the per-request nonce is read server-side and injected via <meta name="csp-nonce"> - Update __root.test.tsx: mock provides useLoaderData and asserts the nonce meta tag is rendered with the correct content Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
// apps/web-tanstack/app.config.ts
|
|
// TanStack Start / Nitro server configuration.
|
|
// Registers the core-shared security headers middleware so every response
|
|
// emits the six security headers and a per-request CSP nonce.
|
|
//
|
|
// Wire-up pattern (Nitro/H3 server hook):
|
|
// withSecurityHeaders() generates nonce + builds six headers.
|
|
// setHeader calls forward them to the response.
|
|
// req.headers["x-nonce"] is set so downstream loaders can call
|
|
// getNonce(event.node.req) from @repo/core-shared/security/tanstack.
|
|
|
|
import { defineConfig } from "@tanstack/start/config";
|
|
import { withSecurityHeaders } from "@repo/core-shared/security/tanstack";
|
|
|
|
interface H3SecurityEvent {
|
|
node: {
|
|
req: { headers: Record<string, string | string[] | undefined> };
|
|
res: { setHeader: (name: string, value: string) => void };
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Nitro/H3 server hook: emits six security headers on every response and
|
|
* forwards the per-request nonce in req.headers["x-nonce"] for downstream
|
|
* access via getNonce() from @repo/core-shared/security/tanstack.
|
|
*/
|
|
export function applySecurityHeaders(event: H3SecurityEvent): void {
|
|
const { nonce, headers } = withSecurityHeaders();
|
|
for (const [k, v] of Object.entries(headers)) {
|
|
event.node.res.setHeader(k, v);
|
|
}
|
|
event.node.req.headers["x-nonce"] = nonce;
|
|
}
|
|
|
|
export default defineConfig({
|
|
server: { hooks: { request: applySecurityHeaders } },
|
|
});
|