fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(web-next): wire security headers middleware and nonce threading

Browse Source 
- Add apps/web-next/middleware.ts calling withSecurityHeaders() from
  core-shared/security/next; exports matcher config excluding static assets
- Update layout.tsx to call getNonce() and render <meta name="csp-nonce">
  so client-side JS can read the per-request nonce
- Update instrumentation-client.ts to read nonce from csp-nonce meta tag
  and pass it to initSentryClient for feedbackIntegration CSP compliance
- Add nonce option to initSentryClient (InitClientOpts.nonce) and thread
  styleNonce + scriptNonce into feedbackIntegration when provided
- Add middleware test asserting all six headers, prod/dev CSP shape, and
  x-nonce presence; add feedbackIntegration nonce tests to core-shared

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Danijel Martinek
2026-05-20 10:10:12 +00:00
parent de458a6d1e
commit b681e906ea
7 changed files with 170 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/web-next/src/app/layout.tsx
View File

@@ -1,4 +1,5 @@
import type { Metadata } from "next";
import { getNonce } from "@repo/core-shared/security/next";
import { Providers } from "./providers";
export const metadata: Metadata = {
@@ -6,13 +7,19 @@ export const metadata: Metadata = {
description: "Clean Architecture Monorepo Template",
};
export default function RootLayout({
export default async function RootLayout({
children,
}: {
children: React.ReactNode;
}) {
const nonce = await getNonce();
return (
<html lang="en">
<head>
{/* nonce exposed to client so instrumentation-client.ts can read it */}
<meta name="csp-nonce" content={nonce} />
</head>
<body>
<Providers>{children}</Providers>
</body>