dimitar
ddd4327a99
Performance and transport-layer hardening. ImageUploader.tsx: - Replaced sequential for-loop uploads with Promise.allSettled, so multiple files upload concurrently. Partial failures no longer abort the whole batch — successful uploads are kept, failed ones surface a concatenated error (and a subsequent retry is still possible). - Order indices are pre-computed from the existing images.length so the parallel results stay correctly ordered. next.config.ts: - PoweredByHeader: false (no longer advertises Next.js). - compress: true explicitly (default, but documented). - Added Strict-Transport-Security, X-Frame-Options, X-Content-Type- Options, Referrer-Policy, Permissions-Policy and a defensive CSP (script-src allows 'unsafe-eval' for Next.js dev/HMR invariants, connect-src whitelists Clerk endpoints). - remotePatterns is now only populated when S3_ENDPOINT is set, and parsed with URL() so a trailing path no longer produces a phantom hostname. Still effectively unused because the app uses raw <img>; the migration to next/image is deferred.
47 lines
1.2 KiB
TypeScript
47 lines
1.2 KiB
TypeScript
import type { NextConfig } from "next";
|
|
|
|
const s3Host = process.env.S3_ENDPOINT
|
|
? new URL(process.env.S3_ENDPOINT).hostname
|
|
: "";
|
|
|
|
const securityHeaders = [
|
|
{ key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
|
|
{ key: "X-Frame-Options", value: "SAMEORIGIN" },
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
|
|
{
|
|
key: "Content-Security-Policy",
|
|
value: [
|
|
"default-src 'self'",
|
|
"img-src 'self' data: blob: https:",
|
|
"font-src 'self' data:",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
|
|
"connect-src 'self' https://*.clerk.accounts.dev https://api.clerk.com",
|
|
"frame-ancestors 'self'",
|
|
].join("; "),
|
|
},
|
|
];
|
|
|
|
const nextConfig: NextConfig = {
|
|
output: "standalone",
|
|
poweredByHeader: false,
|
|
compress: true,
|
|
images: {
|
|
remotePatterns: s3Host
|
|
? [{ protocol: "https", hostname: s3Host }]
|
|
: [],
|
|
},
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: "/:path*",
|
|
headers: securityHeaders,
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|