Commit
add security response headers
commit
b70ba80
1 changed file with +13 and −0
modified next.config.mjs +13 −0
| @@ -14,6 +14,19 @@const nextConfig = { | ||
| 14 | 14 | // CI runs `next lint` explicitly; don't fail production builds on lint. |
| 15 | 15 | ignoreDuringBuilds: true, |
| 16 | 16 | }, |
| 17 | + async headers() { | |
| 18 | + return [ | |
| 19 | + { | |
| 20 | + source: '/:path*', | |
| 21 | + headers: [ | |
| 22 | + { key: 'X-Content-Type-Options', value: 'nosniff' }, | |
| 23 | + { key: 'X-Frame-Options', value: 'SAMEORIGIN' }, | |
| 24 | + { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }, | |
| 25 | + { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' }, | |
| 26 | + ], | |
| 27 | + }, | |
| 28 | + ]; | |
| 29 | + }, | |
| 17 | 30 | }; |
| 18 | 31 | |
| 19 | 32 | export default nextConfig; |