+ specify worker-src (#5443)

+ CSP from main website

Co-authored-by: benedetta davico <[email protected]>

Author: 2 people

documentation/docs/next.config.js

@@ -1067,6 +1067,51 @@ const config = {
     unoptimized: true,
   },
   transpilePackages: ["@nymproject/contract-clients"],
+  async headers() {
+    const isDev = process.env.NODE_ENV === "development";
+    const csp = isDev
+      ? `
+        default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *;
+        script-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: *;
+        font-src 'self' data: blob: *;
+        style-src 'self' 'unsafe-inline' data: blob: *;
+        img-src 'self' data: blob: *;
+        object-src 'self' data: blob: *;
+        base-uri 'self';
+        form-action 'self';
+        frame-ancestors 'self';
+        upgrade-insecure-requests;
+        connect-src 'self' data: blob: *;
+        frame-src 'self' data: blob: *;
+        worker-src 'self' blob: *;
+      `
+      : `
+        default-src 'self';
+        script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live *.nymtech.net *.nymvpn.com *.vercel.app *.nymte.ch *.nyx.network *.nym.com https://nym.com nymvpn.com https://nymvpn.com *.nymtech.cc;
+        font-src 'self' data:;
+        style-src 'self' 'unsafe-inline';
+        img-src 'self';
+        object-src 'none';
+        base-uri 'self';
+        form-action 'self';
+        frame-ancestors 'none';
+        upgrade-insecure-requests;
+        connect-src 'self' https://github.com *.vercel.app *.nymtech.net *.nymvpn.com *.nymte.ch *.nyx.network *.nym.com https://nym.com nymvpn.com https://nymvpn.com *.nymtech.cc;
+        frame-src 'self' https://vercel.live *.vercel.app *.nym.com https://nym.com;
+        worker-src 'self' blob: https://vercel.live *.vercel.app *.nym.com https://nym.com;
+      `;
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: csp.replace(/\s{2,}/g, " ").trim(),
+          }
+        ]
+      }
+    ]
+  }
 };
 
 module.exports = config;