damjan_savicandClaude Sonnet 4.5
4ab5f2ddfe
- Install @next-safe/middleware v0.10.0 package (latest available version) - Add HSTS, Referrer-Policy, and Permissions-Policy back to next.config.ts - These static headers work in next.config.ts, CSP remains in middleware ISSUE ENCOUNTERED: - QA requested @next-safe/middleware v0.13.2 but only v0.10.0 exists in npm registry - Package was manually extracted to node_modules due to installation issues - Attempting to use chainMatch/csp from package causes 500 server errors - Root cause unclear - may be Next.js 15.1 compatibility issue or package API changes CURRENT STATE: - Security headers (HSTS, Referrer-Policy, Permissions-Policy) in next.config.ts - CSP header in middleware.ts using response.headers.set() (Fix Session 1 approach) - Headers still won't appear due to Next.js rewrite bug (as QA Session 2 identified) Package installation attempted in both worktree and main project directories. Manual extraction from npm registry tarball successful but usage causes errors. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
132 lines
3.0 KiB
TypeScript
132 lines
3.0 KiB
TypeScript
import type { NextConfig } from 'next';
|
|
import createMDX from '@next/mdx';
|
|
import createNextIntlPlugin from 'next-intl/plugin';
|
|
|
|
const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
|
|
|
|
const nextConfig: NextConfig = {
|
|
output: 'standalone',
|
|
|
|
pageExtensions: ['js', 'jsx', 'md', 'mdx', 'ts', 'tsx'],
|
|
|
|
images: {
|
|
formats: ['image/avif', 'image/webp'],
|
|
deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048],
|
|
imageSizes: [16, 32, 48, 64, 96, 128, 256, 384],
|
|
remotePatterns: [
|
|
{
|
|
protocol: 'https',
|
|
hostname: 'mxadgucxhmstlzsbgmoz.supabase.co',
|
|
},
|
|
],
|
|
},
|
|
|
|
experimental: {
|
|
optimizePackageImports: ['lucide-react', 'framer-motion'],
|
|
},
|
|
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: '/:path*',
|
|
headers: [
|
|
{
|
|
key: 'X-DNS-Prefetch-Control',
|
|
value: 'on',
|
|
},
|
|
{
|
|
key: 'X-Frame-Options',
|
|
value: 'SAMEORIGIN',
|
|
},
|
|
{
|
|
key: 'X-Content-Type-Options',
|
|
value: 'nosniff',
|
|
},
|
|
{
|
|
key: 'Strict-Transport-Security',
|
|
value: 'max-age=31536000; includeSubDomains; preload',
|
|
},
|
|
{
|
|
key: 'Referrer-Policy',
|
|
value: 'strict-origin-when-cross-origin',
|
|
},
|
|
{
|
|
key: 'Permissions-Policy',
|
|
value: 'geolocation=(), microphone=(), camera=(), payment=(), usb=()',
|
|
},
|
|
// Content-Security-Policy is handled by @next-safe/middleware in src/middleware.ts
|
|
],
|
|
},
|
|
{
|
|
source: '/fonts/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Cache-Control',
|
|
value: 'public, max-age=31536000, immutable',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/images/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Cache-Control',
|
|
value: 'public, max-age=31536000, immutable',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/_next/static/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Cache-Control',
|
|
value: 'public, max-age=31536000, immutable',
|
|
},
|
|
],
|
|
},
|
|
// Content-Language Headers für jede Sprache (wichtig für Bing)
|
|
{
|
|
source: '/de/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Content-Language',
|
|
value: 'de-DE',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/en/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Content-Language',
|
|
value: 'en-US',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
source: '/sr/:path*',
|
|
headers: [
|
|
{
|
|
key: 'Content-Language',
|
|
value: 'sr-RS',
|
|
},
|
|
],
|
|
},
|
|
];
|
|
},
|
|
|
|
// Compiler-Optimierungen
|
|
compiler: {
|
|
removeConsole: process.env.NODE_ENV === 'production',
|
|
},
|
|
};
|
|
|
|
const withMDX = createMDX({
|
|
options: {
|
|
remarkPlugins: [],
|
|
rehypePlugins: [],
|
|
},
|
|
});
|
|
|
|
export default withNextIntl(withMDX(nextConfig));
|