damjan_savicandClaude Sonnet 4.5
a2b919c6ca
- Refactor src/middleware.ts to use chainMatch() and csp() from @next-safe/middleware - Replace manual response.headers.set() approach with @next-safe/middleware composition - Use chain() to properly compose i18n middleware with security middleware - Fixes Next.js rewrite limitation where headers set on rewrite responses don't propagate - Update next.config.ts comment to reflect correct CSP implementation Implements QA Session 2 fix request (previously not implemented correctly). Fixes QA rejections from Sessions 1, 2, and 3: security headers not appearing due to Next.js rewrite edge case (GitHub Issue #70515). Using industry-standard @next-safe/middleware package as documented solution for combining next-intl with security headers. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
133 lines
3.1 KiB
TypeScript
133 lines
3.1 KiB
TypeScript
import type { NextConfig } from 'next';
|
|
import createMDX from '@next/mdx';
|
|
import createNextIntlPlugin from 'next-intl/plugin';
|
|
|
|
const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
|
|
|
|
const nextConfig: NextConfig = {
|
|
output: 'standalone',
|
|
|
|
pageExtensions: ['js', 'jsx', 'md', 'mdx', 'ts', 'tsx'],
|
|
|
|
images: {
|
|
formats: ['image/avif', 'image/webp'],
|
|
deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048],
|
|
imageSizes: [16, 32, 48, 64, 96, 128, 256, 384],
|
|
remotePatterns: [
|
|
{
|
|
protocol: 'https',
|
|
hostname: 'mxadgucxhmstlzsbgmoz.supabase.co',
|
|
},
|
|
],
|
|
},
|
|
|
|
experimental: {
|
|
optimizePackageImports: ['lucide-react', 'framer-motion'],
|
|
},
|
|
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: '/:path*',
|
|
headers: [
|
|
{
|
|
key: 'X-DNS-Prefetch-Control',
|
|
value: 'on',
|
|
},
|
|
{
|
|
key: 'X-Frame-Options',
|
|
value: 'SAMEORIGIN',
|
|
},
|
|
{
|
|
key: 'X-Content-Type-Options',
|
|
value: 'nosniff',
|
|
},
|
|
{
|
|
key: 'Strict-Transport-Security',
|
|
value: 'max-age=31536000; includeSubDomains; preload',
|
|
},
|
|
{
|
|
key: 'Referrer-Policy',
|
|
value: 'strict-origin-when-cross-origin',
|
|
},
|
|
{
|
|
key: 'Permissions-Policy',
|
|
value: 'geolocation=(), microphone=(), camera=(), payment=(), usb=()',
|
|
},
|
|
// Content-Security-Policy is handled by @next-safe/middleware in src/middleware.ts
|
|
// Other security headers (HSTS, Referrer-Policy, Permissions-Policy) are static and configured here
|
|
],
|
|
},
|
|
{
|
|
source: '/fonts/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Cache-Control',
|
|
value: 'public, max-age=31536000, immutable',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/images/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Cache-Control',
|
|
value: 'public, max-age=31536000, immutable',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/_next/static/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Cache-Control',
|
|
value: 'public, max-age=31536000, immutable',
|
|
},
|
|
],
|
|
},
|
|
// Content-Language Headers für jede Sprache (wichtig für Bing)
|
|
{
|
|
source: '/de/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Content-Language',
|
|
value: 'de-DE',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/en/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Content-Language',
|
|
value: 'en-US',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/sr/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Content-Language',
|
|
value: 'sr-RS',
|
|
},
|
|
],
|
|
},
|
|
];
|
|
},
|
|
|
|
// Compiler-Optimierungen
|
|
compiler: {
|
|
removeConsole: process.env.NODE_ENV === 'production',
|
|
},
|
|
};
|
|
|
|
const withMDX = createMDX({
|
|
options: {
|
|
remarkPlugins: [],
|
|
rehypePlugins: [],
|
|
},
|
|
});
|
|
|
|
export default withNextIntl(withMDX(nextConfig));
|