Develop

apps/leafcutter/next.config.js

@@ -1,14 +1,22 @@
+const ContentSecurityPolicy = `
+  default-src 'self';
+  script-src 'self';
+  child-src example.com;
+  style-src 'self' example.com;
+  font-src 'self';
+`;
+
 module.exports = {
   publicRuntimeConfig: {
     embedded: true
-  },
+  },/*
   basePath: "/proxy/leafcutter",
   assetPrefix: "/proxy/leafcutter",
   i18n: {
     locales: ["en", "fr"],
     defaultLocale: "en",
   },
-
+*/
   /*   rewrites: async () => ({
     fallback: [
       {
@@ -17,4 +25,31 @@ module.exports = {
       },
     ],
   }) */
+  async headers() {
+    return [
+      {
+        source: '/:path*',
+        headers: [
+          /*
+          {
+            key: 'Content-Security-Policy',
+            value: ContentSecurityPolicy.replace(/\s{2,}/g, ' ').trim()
+          },
+          */
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=63072000; includeSubDomains; preload'
+          },
+          {
+            key: 'X-XSS-Protection',
+            value: '1; mode=block'
+          },
+          {
+            key: 'X-Frame-Options',
+            value: 'SAMEORIGIN'
+          }
+        ],
+      },
+    ]
+  }
 };