CSP & Security Headers
Konfigurasi Content Security Policy, HSTS, X-Frame-Options, dan keamanan TLS pada next.config.ts.
Status: Stablev1.0.0Source Verified: Yes
Source:
next.config.ts, src/middleware.tsTests: tests/unit/authPolicy.test.tsContent Security Policy & Security Headers#
Spesifikasi header keamanan HTTP yang diinjeksikan pada setiap respons web Next.js melalui next.config.ts.
1. Content Security Policy (CSP)#
text
text
1default-src 'self';2script-src 'self' 'unsafe-inline' https://apis.google.com;3style-src 'self' 'unsafe-inline';4img-src 'self' data: blob: https://res.cloudinary.com;5connect-src 'self' https://*.firebaseio.com https://identitytoolkit.googleapis.com https://*.hivemq.cloud;6frame-ancestors 'none';
2. Header Keamanan HTTP Tambahan#
| Security Header | Value | Fungsi Proteksi |
|---|---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | Memaksa koneksi HTTPS selama 2 tahun |
X-Frame-Options | DENY | Mencegah serangan Clickjacking |
X-Content-Type-Options | nosniff | Mencegah MIME-type sniffing |
Referrer-Policy | strict-origin-when-cross-origin | Membatasi kebocoran URL asal |
Permissions-Policy | camera=(self), microphone=(), geolocation=() | Membatasi akses hardware hanya untuk kamera |