From e7fab851945892f609bae88f271313cc3bdbb578 Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Tue, 13 Jun 2023 22:12:32 +0800
Subject: [PATCH] Update CSP move it into next config

---
 packages/web/next.config.js | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/packages/web/next.config.js b/packages/web/next.config.js
index 19fd0aacf..1ef122c74 100644
--- a/packages/web/next.config.js
+++ b/packages/web/next.config.js
@@ -1,3 +1,17 @@
+const ContentSecurityPolicy = `
+  default-src 'none';
+  base-uri 'self';
+  block-all-mixed-content;
+  connect-src 'self' api-prod.omnivore.app api-demo.omnivore.app;
+  font-src 'self';
+  form-action 'self' api-prod.omnivore.app api-demo.omnivore.app;
+  frame-ancestors 'none';
+  frame-src 'none';
+  manifest-src 'self';
+  script-src script-src 'self' 'unsafe-inline';
+  style-src 'self' 'unsafe-inline';
+`
+
 const moduleExports = {
   images: {
     domains: [
@@ -24,6 +38,12 @@ const moduleExports = {
       destination: `https://api-${process.env.NEXT_PUBLIC_APP_ENV}.omnivore.app/api/mobile-auth/:path*`,
     },
   ],
+  Headers: [
+    {
+      key: 'Content-Security-Policy',
+      value: ContentSecurityPolicy.replace(/\s{2,}/g, ' ').trim(),
+    },
+  ],
   async redirects() {
     return [
       {