search

nibtime / next-safe-middleware

Strict CSP (Content-Security-Policy) for Next.js hybrid apps https://web.dev/strict-csp/
https://next-safe-middleware.vercel.app
MIT License
79 stars 20 forks source link

Issues when using Next.js with basePath #48

Closed renet closed 2 years ago

renet commented 2 years ago

When using Next.js (18) with a basePath set in next.config.js (in our case it has a value of "/dashboard"), it seems like the script-hashes.txt and style-hashes.txt files cannot be accessed by the middleware when processing the requests. This results in errors like

TypeError: default-src 'self';object-src 'none';base-uri 'none';connect-src 'self' ws://localhost:3000/;font-src 'self';img-src 'self' data:;script-src 'unsafe-inline' <!DOCTYPE html><html><!-- full content of the 404 page --></html> 'unsafe-hashes' is not a legal HTTP header value

Using Next.js > 12.2, yarn 3.2.1 and Node 16. If you need any further information, please let me know. And thanks for a great project! :)

nibtime commented 2 years ago

Hi @renet

thanks for reporting this! Sorry for the little late reply, I was busy with a PR (#47) to fix stuff for Next 12.2 and other things lately. Fortunately, this one was an easy fix, it will be included in the 0.9.0 release. Also recommended for lots of other 12.2 fixes and when you host on Vercel because of #45.

nibtime commented 2 years ago

@all-contributors add @renet for bug

allcontributors[bot] commented 2 years ago

@nibtime

I've put up a pull request to add @renet! :tada: