pullchain/next.config.ts at main · mojeebdev/pullchain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
import type { NextConfig } from 'next';

/**
 * CSP aligned with Privy guidance:
 * https://docs.privy.io/security/implementation-guide/content-security-policy
 *
 * Base domain note from Privy: if a base domain is enabled, you must also allow
 * the domain-specific Privy instance (e.g. https://privy.pullchain.fun).
 *
 * App-specific allowlist (fonts + Vercel Analytics) is separate from Privy and kept minimal.
 */
const PRIVY_BASE_DOMAIN = 'https://privy.pullchain.fun';

const contentSecurityPolicy = [
  "default-src 'self'",
  // Next.js + Cloudflare Turnstile (CAPTCHA) + Vercel Analytics
  "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://va.vercel-scripts.com",
  // Inline styles (app) + Google Fonts / Fontshare CSS
  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://api.fontshare.com",
  "img-src 'self' data: blob: https:",
  "font-src 'self' data: https://fonts.gstatic.com https://cdn.fontshare.com",
  "object-src 'none'",
  "base-uri 'self'",
  "form-action 'self'",
  "frame-ancestors 'none'",
  // Privy iframe + WalletConnect verify + CAPTCHA + custom Privy base domain
  [
    'child-src',
    'https://auth.privy.io',
    PRIVY_BASE_DOMAIN,
    'https://verify.walletconnect.com',
    'https://verify.walletconnect.org',
  ].join(' '),
  [
    'frame-src',
    'https://auth.privy.io',
    PRIVY_BASE_DOMAIN,
    'https://*.privy.io',
    'https://verify.walletconnect.com',
    'https://verify.walletconnect.org',
    'https://challenges.cloudflare.com',
  ].join(' '),
  // Privy API (default + base domain), WC relays, Coinbase WalletLink, Privy RPC, Base
  // Use host origins only — never put full RPC URLs (may contain path keys) in CSP.
  [
    'connect-src',
    "'self'",
    'https://auth.privy.io',
    PRIVY_BASE_DOMAIN,
    'https://*.privy.io',
    'https://*.rpc.privy.systems',
    'wss://relay.walletconnect.com',
    'wss://relay.walletconnect.org',
    'wss://www.walletlink.org',
    'https://explorer-api.walletconnect.com',
    'https://*.walletconnect.com',
    'https://api.web3modal.org',
    'https://mainnet.base.org',
    'https://*.g.alchemy.com',
    'https://va.vercel-scripts.com',
    'https://vitals.vercel-insights.com',
  ].join(' '),
  "worker-src 'self'",
  "manifest-src 'self'",
]
  .join('; ')
  .replace(/\s+/g, ' ')
  .trim();

const nextConfig: NextConfig = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
          { key: 'Content-Security-Policy', value: contentSecurityPolicy },
          ...(process.env.NODE_ENV === 'production'
            ? [{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }]
            : []),
        ],
      },
    ];
  },
};

export default nextConfig;