Danijel Martinek
082d4d2369
Add Next.js middleware.ts to apps/cms that applies all six security headers on every response using the framework-agnostic buildSecurityHeaders builder. No nonce is generated or forwarded — the CMS is server-side only so CSP nonces are not required. Includes a test suite mirroring the web-next pattern that asserts all six headers are set, no x-nonce is emitted, and CSP mode switches correctly between dev (unsafe-inline) and prod (strict-dynamic). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
19 lines
605 B
TypeScript
19 lines
605 B
TypeScript
import { buildSecurityHeaders } from "@repo/core-shared/security";
|
|
import type { NextRequest } from "next/server";
|
|
import { NextResponse } from "next/server";
|
|
|
|
export function middleware(_request: NextRequest): NextResponse {
|
|
const mode = process.env.NODE_ENV === "production" ? "prod" : "dev";
|
|
const secHeaders = buildSecurityHeaders({ mode });
|
|
|
|
const response = NextResponse.next();
|
|
for (const [name, value] of Object.entries(secHeaders)) {
|
|
response.headers.set(name, value);
|
|
}
|
|
return response;
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
|
|
};
|