From 0558b4187e50ec1ae46b1469208b75c02844d3a6 Mon Sep 17 00:00:00 2001 From: Abubeker Yasin Date: Sun, 5 Jul 2026 22:38:52 +0300 Subject: [PATCH] fix: ( csp ) add nonce-based Content-Security-Policy (CSP) --- .../backoffice/src/app/layout.tsx | 4 + .../backoffice/src/app/tickets/page.tsx | 6 +- .../backoffice/src/middleware.ts | 87 +++++++++++++++-- .../portal/src/app/layout.tsx | 4 + .../portal/src/middleware.ts | 96 +++++++++++++++---- 5 files changed, 170 insertions(+), 27 deletions(-) diff --git a/apps/edr-passenger-web/backoffice/src/app/layout.tsx b/apps/edr-passenger-web/backoffice/src/app/layout.tsx index 23838f62c..b302ee74d 100644 --- a/apps/edr-passenger-web/backoffice/src/app/layout.tsx +++ b/apps/edr-passenger-web/backoffice/src/app/layout.tsx @@ -1,4 +1,5 @@ import type { Metadata } from 'next'; +import { headers } from 'next/headers'; import '@/styles/globals.css'; import Providers from './providers'; @@ -12,10 +13,13 @@ export default function RootLayout({ }: { children: React.ReactNode; }) { + // Nonce set per-request by middleware; required for this inline script under the CSP. + const nonce = headers().get('x-nonce') ?? undefined; return (