@@ -12,6 +12,12 @@ const TOKEN_COOKIE = "token";
1212const AUTH_USER_HEADER = "x-authenticated-user" ;
1313const NONCE_HEADER = "x-nonce" ;
1414const CSP_HEADER = "Content-Security-Policy" ;
15+ const STATIC_STYLE_HASHES = [
16+ "'sha256-wOOlbQsHffPa/XeSzb/hyZtdNuMNE9EDJ9dYETiwQ80='" ,
17+ "'sha256-C8S6dNMSWod6IgqRVGm5rD7fWajo34AG++yTnMbIeks='" ,
18+ "'sha256-Z5XTK23DFuEMs0PwnyZDO9SWxemQ5HxcpVaBNuUJyWY='" ,
19+ "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='" ,
20+ ] ;
1521const isProduction = process . env . NODE_ENV === "production" ;
1622const jwtSecret = process . env . JWT_SECRET ;
1723
@@ -25,15 +31,19 @@ const buildContentSecurityPolicy = ( nonce: string ): string => {
2531 const scriptSrcElem = isDev
2632 ? "'self' 'unsafe-inline' https://va.vercel-scripts.com"
2733 : `'self' 'nonce-${ nonce } ' https://va.vercel-scripts.com` ;
34+ const staticStyleHashes = STATIC_STYLE_HASHES . join ( " " ) ;
2835 const styleSrc = isDev
2936 ? "'self' 'unsafe-inline'"
30- : `'self' 'nonce-${ nonce } '` ;
37+ : `'self' 'nonce-${ nonce } ' ${ staticStyleHashes } ` ;
38+ const styleSrcElem = isDev
39+ ? "'self' 'unsafe-inline'"
40+ : `'self' 'nonce-${ nonce } ' ${ staticStyleHashes } ` ;
3141 const cspHeader = `
3242 default-src 'self';
3343 script-src ${ scriptSrc } ;
3444 script-src-elem ${ scriptSrcElem } ;
3545 style-src ${ styleSrc } ;
36- style-src-elem ${ styleSrc } ;
46+ style-src-elem ${ styleSrcElem } ;
3747 style-src-attr 'unsafe-inline';
3848 img-src 'self' blob: data: https://images.ygoprodeck.com https://images.unsplash.com https://tailwindcss.com https://raw.githubusercontent.com;
3949 font-src 'self' data:;
0 commit comments