- Move CSP, HSTS, Referrer-Policy, and Permissions-Policy from next.config.ts to middleware
- Compose headers with next-intl middleware to ensure they propagate through rewrites
- Security headers now set via response.headers.set() in middleware after i18n routing
- All security headers should now appear in HTTP responses
Fixes QA issue: headers from next.config.ts not appearing due to middleware rewrites
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Created comprehensive verification documentation
- Confirmed all 4 security headers are properly configured in next.config.ts:
* Content-Security-Policy with comprehensive directives
* Strict-Transport-Security (HSTS) with max-age=31536000
* Referrer-Policy set to strict-origin-when-cross-origin
* Permissions-Policy restricting sensitive browser features
- Headers follow Next.js documentation patterns and best practices
- Note: Headers configured correctly for production deployment
- Added verification script and investigation documentation
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add 15 optimized WebP images for portfolio (21-53KB each)
- Redesign Hero section with full-width background image
- Add SSR support for Hero component
- Update About section with new portrait image
- Update Contact page with professional headshot
- Add images to Services/Leistungen page
- Add image optimization script (sharp)
- Update translations for gallery section
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
damjan_savicandClaude Sonnet 4.5