search

nibtime / next-safe-middleware

Strict CSP (Content-Security-Policy) for Next.js hybrid apps https://web.dev/strict-csp/
https://next-safe-middleware.vercel.app
MIT License
78 stars 20 forks source link

Problems appending directives #82

Open CarstenHoyer opened 1 year ago

CarstenHoyer commented 1 year ago

Hi, I have the following:

const securityMiddleware = [
    nextSafe({
        isDev,
        contentSecurityPolicy: {
            "connect-src": ["https://*.segment.com/"],
        },
    }),
    strictDynamic({}),
];

export default chainMatch(isPageRequest)(...securityMiddleware);

But segment.com is not being appended to the connect-src directives. I have also tried with disableCsp and using the cap middleware, but then I run into other issues (I need to build the whole directive myself).

What Am I doing wrong?