nibtime / next-safe-middleware

Strict CSP (Content-Security-Policy) for Next.js hybrid apps https://web.dev/strict-csp/
https://next-safe-middleware.vercel.app
MIT License
78 stars 20 forks source link

csp-manifest.json in wrong directory #86

Open Cirelion opened 1 year ago

Cirelion commented 1 year ago

I have a app that's running on NextJS using NX as a monorepo tool. The consequence of this is that my .next directory is in a different directory from the project root. next-safe-middleware seems to inject a directory called ~csp into the .next/static directory. This is wrong for my use-case and is the most likely reason for next-safe-middleware not working in my app.

Is there any way to override the default .next directory location?

adriancornea commented 1 year ago

Hi @Cirelion I encountered the same issue, any luck finding a workaround?

Cirelion commented 1 year ago

I ended up ignoring this particular part of the issue, implementing the rest of the recommended steps. I think adding gsspWithNonce() to all getServerSideProps calls that require the CSP stuff will work.