@strict-csp/builder package + middleware fixes for Vercel

nibtime / next-safe-middleware

Strict CSP (Content-Security-Policy) for Next.js hybrid apps https://web.dev/strict-csp/

https://next-safe-middleware.vercel.app

MIT License

78 stars 20 forks source link

Closed nibtime closed 2 years ago

nibtime commented 2 years ago

first step of #66

CSP typings are maintained within @strict-csp/builder package
some hotfixes for bad middleware-related bugs that can break CSP (on Vercel only)

changeset-bot[bot] commented 2 years ago

Latest commit: 8283af829620686628511bfc95e9b75d94a9b432

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

| Name | Type | | --------------------- | ----- | | @strict-csp/builder | Minor | | @next-safe/middleware | Patch | | docs | Patch | | e2e | Patch |

vercel[bot] commented 2 years ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
docs-next-safe-middleware	✅ Ready (Inspect)	Visit Preview	Aug 5, 2022 at 1:43PM (UTC)
e2e-next-safe-middleware	✅ Ready (Inspect)	Visit Preview	Aug 5, 2022 at 1:43PM (UTC)

nibtime commented 2 years ago

Manually tested the e2e app with a real iPad Pro device on Safari >=15.4 with strict-dynamic:

Notes:

Safari only serves the report-uri directive and I can confirm that violation reports are received at /api/reporting. That's why it is important to always serve both reporting directives, even though report-uri is flagged deprecated.
Safari doesn't execute web worker inline test script with partytown