hamed
194ffd889c
- Added isomorphic-dompurify for improved XSS protection - Refactored token storage to use in-memory management for access tokens - Implemented server-side route handlers for OAuth token management - Introduced security headers in next.config.js - Removed client-side exposure of client_secret and sensitive tokens - Updated API interceptors to handle token refresh logic - Cleaned up cookie management for refresh tokens
74 lines
1.9 KiB
JavaScript
74 lines
1.9 KiB
JavaScript
// next.config.js
|
|
const nextConfig = {
|
|
// Add other configurations below
|
|
reactStrictMode: true,
|
|
images: {
|
|
remotePatterns: [
|
|
{
|
|
protocol: 'https',
|
|
hostname: 'api.clinic-pro.ir',
|
|
},
|
|
{
|
|
protocol: 'http',
|
|
hostname: 'api.clinic-pro.ir',
|
|
},
|
|
{
|
|
protocol: 'https',
|
|
hostname: 'back-dev.clinic-pro.ir',
|
|
},
|
|
{
|
|
protocol: 'https',
|
|
hostname: 'clinic-pro-back.ddev.site',
|
|
},
|
|
{
|
|
protocol: 'https',
|
|
hostname: 'clinic-pro.ddev.site',
|
|
},
|
|
{
|
|
protocol: 'http',
|
|
hostname: 'clinic-pro.ddev.site',
|
|
},
|
|
],
|
|
},
|
|
env: {
|
|
// Make DEV_MODE available to the application
|
|
DEV_MODE: process.env.DEV_MODE,
|
|
},
|
|
// Additional configuration for better Docker support
|
|
trailingSlash: false,
|
|
compress: true,
|
|
poweredByHeader: false,
|
|
// Enable standalone output for Docker
|
|
output: 'standalone',
|
|
async headers() {
|
|
const csp = [
|
|
"default-src 'self'",
|
|
"img-src 'self' https: data: blob:",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"font-src 'self' data:",
|
|
"connect-src 'self' https://api.clinic-pro.ir https://back-dev.clinic-pro.ir",
|
|
"frame-ancestors 'none'",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
].join('; ');
|
|
|
|
return [
|
|
{
|
|
source: '/(.*)',
|
|
headers: [
|
|
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
|
|
{ key: 'X-Frame-Options', value: 'DENY' },
|
|
{ key: 'X-Content-Type-Options', value: 'nosniff' },
|
|
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
|
|
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
|
|
{ key: 'Content-Security-Policy', value: csp },
|
|
],
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
module.exports = nextConfig;
|