twotalesanimation
08b6e58b8e
Deploy Vault CMS / deploy (push) Successful in 2m23s
- Upgrade next 16.0.3 -> 16.3.5 and react/react-dom 19.2.0 -> 19.3.0 (CVE-2025-55182 / CVE-2025-66478 unauthenticated RCE), next-auth -> 4.24.15 - Require admin role on /api/users, /api/courses and /api/enrollments, which were unauthenticated - Replace ALLOWED_ADMINS checks that allowed any signed-in user when the variable was empty with the role-based requireAdmin - Sanitize upload filenames, restrict thumbnail extensions, store edited thumbnails in UPLOADS_DIR, tighten traversal checks in file routes - Dockerfile: Node 22, pinned pnpm, non-root user, critical audit gate - Compose: read-only rootfs, dropped caps, no-new-privileges, Postgres password from env - Exclude .env from Docker build context; add security headers - Deploy with git reset --hard instead of git pull - Remove stale package-lock.json Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
33 lines
937 B
TypeScript
33 lines
937 B
TypeScript
import type { NextConfig } from "next";
|
|
|
|
const securityHeaders = [
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
|
|
// Limited to directives that don't conflict with Next.js inline scripts:
|
|
// blocks <base> tag hijacking, plugin content, and framing (clickjacking)
|
|
{
|
|
key: "Content-Security-Policy",
|
|
value: "base-uri 'self'; object-src 'none'; frame-ancestors 'none'",
|
|
},
|
|
];
|
|
|
|
const nextConfig: NextConfig = {
|
|
poweredByHeader: false,
|
|
images: {
|
|
remotePatterns: [
|
|
{
|
|
protocol: "https",
|
|
hostname: "lh3.googleusercontent.com",
|
|
pathname: "/**",
|
|
},
|
|
],
|
|
},
|
|
async headers() {
|
|
return [{ source: "/:path*", headers: securityHeaders }];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|