forked from soruly/trace.moe-www
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathnext.config.js
41 lines (40 loc) · 1.62 KB
/
next.config.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
const { NEXT_PUBLIC_API_ENDPOINT } = process.env;
const { NEXT_PUBLIC_MEDIA_ENDPOINT } = process.env;
const { NEXT_PUBLIC_ANILIST_ENDPOINT = "https://graphql.anilist.co" } = process.env;
module.exports = {
async headers() {
return [
{
source: "/(.*)",
headers: [
{ key: "Access-Control-Allow-Origin", value: "*" },
{ key: "Access-Control-Allow-Methods", value: "GET, POST, PUT, OPTIONS" },
{
key: "Access-Control-Allow-Headers",
value: "Content-Type, x-trace-secret",
},
{ key: "Referrer-Policy", value: "no-referrer" },
{ key: "X-Content-Type-Options", value: "nosniff" },
{
key: "Content-Security-Policy",
value: [
"default-src 'self'",
"script-src 'self' 'unsafe-eval' www.google-analytics.com static.cloudflareinsights.com",
"style-src * 'self' 'unsafe-inline'",
`img-src * 'self' data: blob: ${NEXT_PUBLIC_MEDIA_ENDPOINT}`,
"font-src 'self'",
"frame-src www.youtube-nocookie.com www.youtube.com www.google.com",
`media-src blob: 'self' ${NEXT_PUBLIC_MEDIA_ENDPOINT}`,
"form-action 'self'",
"base-uri 'none'",
"frame-ancestors 'none'",
"manifest-src 'self'",
"block-all-mixed-content",
`connect-src blob: 'self' ${NEXT_PUBLIC_API_ENDPOINT} ${NEXT_PUBLIC_MEDIA_ENDPOINT} ${NEXT_PUBLIC_ANILIST_ENDPOINT} www.google-analytics.com stats.g.doubleclick.net`,
].join("; "),
},
],
},
];
},
};