Daniel/webshop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sec: Add form-action to CSP and remove duplicate HSTS header based on ZAP report
All checks were successful
Staging Build / build (push) Successful in 2m37s
Details

Browse Source
This commit is contained in:
DanielS
2026-06-25 17:20:27 +02:00
parent f44cf1a5f6
commit 08382ff4a1
2 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -2,3 +2,4 @@ example_data/
shop/Leitfaden shop/Leitfaden
.gitignore .gitignore
db-access.txt db-access.txt
2026-06-25-ZAP-Report-.json

6
shop/next.config.ts
View File

@@ -17,13 +17,9 @@ const nextConfig: NextConfig = {
key: 'X-Content-Type-Options', key: 'X-Content-Type-Options',
value: 'nosniff', value: 'nosniff',
}, },
{
key: 'Strict-Transport-Security',
value: 'max-age=31536000; includeSubDomains; preload',
},
{ {
key: 'Content-Security-Policy', key: 'Content-Security-Policy',
value: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self' data:; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://*.supabase.net wss://*.supabase.net; frame-ancestors 'self';", value: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self' data:; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://*.supabase.net wss://*.supabase.net; frame-ancestors 'self'; form-action 'self';",
}, },
], ],
}, },