`defineRouteRules` CSP headers not taken into account

[DamianGlowala]

Version

nuxt-security: 2.0.0-beta.5 nuxt: 3.11.2

Reproduction Link

Steps to reproduce

What is Expected?

The following config isn't taken into account when placed in one of the pages:

defineRouteRules({
    security: {
        headers: {
            contentSecurityPolicy: {
                'connect-src': [
                    'https://*.googleapis.com',
                    '*.google.com',
                    'https://*.gstatic.com'
                ],
                'frame-src': [
                    '*.google.com'
                ],
                'font-src': [
                    'https://fonts.gstatic.com'
                ],
                'style-src': [
                    'https://fonts.googleapis.com'
                ],
                'img-src': [
                    'https://*.googleapis.com',
                    'https://*.gstatic.com',
                    '*.google.com'
                ]
            }
        }
    }
})

What is actually happening?

Clearly only the default values declared in nuxt.config file are displayed:

(I do have experimental.inlineRouteRules enabled.)

[vejja]

Hi @DamianGlowala The inline definitions of defineRouteRules work correctly on my side. Are you navigating on the client-side or are you hard-reloading the page from the server ? Cf https://nuxt-security.vercel.app/documentation/advanced/strict-csp#per-route-csp

[DamianGlowala]

Hi @vejja,

Thank you for checking them on your side! I think I'll need to provide a minimal reproduction; I hope I'll manage to make one.

Headers are absent in both cases - after a client-side navigation and when entering the page after a reload.

The link you sent explains quite a lot though and it turns out inline CSP headers aren't a good choice for my project.

[vejja]

Edit: Is your page pre-rendered ? This might actually be a corner case

[DamianGlowala]

Nope, it's an SSR app with no prerendered pages.

[vejja]

OK, let me know if you can provide a repro. There might be something to fix.

[DamianGlowala]

(I'll reopen if I manage to provide a reproduction.)