Skip to content

fix(security): implement CSP headers for Next.js web app#433

Open
JosephOnuh wants to merge 1 commit into
AnnabelJoe:mainfrom
JosephOnuh:fix/333-csp-headers
Open

fix(security): implement CSP headers for Next.js web app#433
JosephOnuh wants to merge 1 commit into
AnnabelJoe:mainfrom
JosephOnuh:fix/333-csp-headers

Conversation

@JosephOnuh
Copy link
Copy Markdown
Contributor

@JosephOnuh JosephOnuh commented Jun 1, 2026

Closes #333

Changes

  • Nonce-based CSP via src/middleware.ts (no unsafe-inline/unsafe-eval for scripts)
  • connect-src restricted to Supabase and Stellar endpoints
  • frame-ancestors: none prevents clickjacking
  • CSP violations reported to /api/csp-report endpoint

@JosephOnuh
fix(security): implement CSP headers for Next.js web app (AnnabelJoe#333
2834203 
)

- Nonce-based CSP via middleware (no unsafe-inline/unsafe-eval for scripts)
- Restricts connect-src to Supabase and Stellar endpoints
- frame-ancestors: none prevents clickjacking
- CSP violations reported to /api/csp-report endpoint
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Implement Content Security Policy (CSP) headers for the web app

1 participant

@JosephOnuh