feat(nextjs): Use strict param in CSP generation #5648
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🦋 Changeset detectedLatest commit: c75997b The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
There was a problem hiding this comment.
Pull Request Overview
This PR updates the Content Security Policy (CSP) configuration in the Next.js package to replace the mode string with a boolean strict parameter, enhancing security by conditionally applying the 'strict-dynamic' attribute and generating a nonce.
- Replaces the CSP mode string with a boolean "strict" parameter in both API and documentation.
- Updates related middleware and tests accordingly.
- Removes the deprecated CSPMode type to streamline the API.
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| packages/nextjs/src/server/content-security-policy.ts | Updates CSP generation functions and documentation to use "strict" |
| packages/nextjs/src/server/clerkMiddleware.ts | Adapts usage of createCSPHeader to the new "strict" parameter |
| packages/nextjs/src/server/tests/content-security-policy.test.ts | Adjusts test cases to reflect the boolean "strict" parameter |
| .changeset/free-crews-sin.md | Updates the changeset to communicate the change in CSP configuration |
dstaley
approved these changes
Apr 16, 2025
tmilewski
approved these changes
Apr 16, 2025
wobsoriano
pushed a commit
that referenced
this pull request
Apr 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
We are going to adjust the CSP configuration option from
modeto booleanstrictFixes: SDKI-995
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change