Security Headers
Security headers used to protect your application.
@repo/security uses Nosecone to set security-related HTTP response headers.
Configuration
Here are the headers we have enabled:
Cross-Origin-Embedder-Policy(COEP)Cross-Origin-Opener-PolicyCross-Origin-Resource-PolicyOrigin-Agent-ClusterReferrer-PolicyStrict-Transport-Security(HSTS)X-Content-Type-OptionsX-DNS-Prefetch-ControlX-Download-OptionsX-Frame-OptionsX-Permitted-Cross-Domain-PoliciesX-XSS-Protection
See the Nosecone reference for details on each header and configuration options.
Usage
Recommended headers are set by default and configured in @repo/security/middleware. Changing the configuration here will affect all apps.
They are then attached to the response within the middleware in apps/app/middleware and apps/web/middleware.ts. Adjusting the configuration in these files will only affect the specific app.
Content Security Policy (CSP)
No CSP header is set. A correct policy depends on which integrations are switched on, so there is no value that is right for every configuration of this repository.
Set it through the Nosecone configuration. The policy below covers the integrations wired here:
import type { NoseconeOptions } from '@nosecone/next';
import { defaults as noseconeDefaults } from '@nosecone/next';
const noseconeOptions: NoseconeOptions = {
...noseconeDefaults,
contentSecurityPolicy: {
...noseconeDefaults.contentSecurityPolicy,
directives: {
...noseconeDefaults.contentSecurityPolicy.directives,
scriptSrc: [
// We have to use unsafe-inline because next-themes does not support nonce
// https://github.com/pacocoursey/next-themes/issues/106
//...noseconeDefaults.contentSecurityPolicy.directives.scriptSrc,
"'self'",
"'unsafe-inline'",
"https://www.googletagmanager.com",
"https://*.clerk.accounts.dev",
],
connectSrc: [
...noseconeDefaults.contentSecurityPolicy.directives.connectSrc,
"https://*.clerk.accounts.dev",
"https://*.google-analytics.com",
"https://clerk-telemetry.com",
],
workerSrc: [
...noseconeDefaults.contentSecurityPolicy.directives.workerSrc,
"blob:",
"https://*.clerk.accounts.dev"
],
imgSrc: [
...noseconeDefaults.contentSecurityPolicy.directives.imgSrc,
"https://img.clerk.com"
],
objectSrc: [
...noseconeDefaults.contentSecurityPolicy.directives.objectSrc,
],
// We only set this in production because the server may be started
// without HTTPS
upgradeInsecureRequests: process.env.NODE_ENV === "production",
},
},
}