@dargmuesli/nuxt-vio 8.3.3 → 8.4.0

package/nuxt.config.ts

@@ -51,10 +51,42 @@ export default defineNuxtConfig(
         '@nuxtjs/tailwindcss',
         '@nuxtseo/module',
         '@pinia/nuxt',
+        // nuxt-security: remove invalid `'none'`s
+        (_options, nuxt) => {
+          const nuxtConfigSecurity = nuxt.options.security
+
+          if (
+            typeof nuxtConfigSecurity.headers !== 'boolean' &&
+            nuxtConfigSecurity.headers.contentSecurityPolicy &&
+            typeof nuxtConfigSecurity.headers.contentSecurityPolicy !==
+              'boolean' &&
+            typeof nuxtConfigSecurity.headers.contentSecurityPolicy !== 'string'
+          ) {
+            for (const [key, value] of Object.entries(
+              nuxtConfigSecurity.headers.contentSecurityPolicy,
+            )) {
+              if (!Array.isArray(value)) continue
+
+              const valueFiltered = value.filter((x) => x !== "'none'")
+
+              if (valueFiltered.length) {
+                ;(
+                  nuxtConfigSecurity.headers.contentSecurityPolicy as Record<
+                    string,
+                    any
+                  >
+                )[key] = [...new Set(valueFiltered)]
+              }
+            }
+          }
+        },
         'nuxt-security',
       ],
       nitro: {
         compressPublicAssets: true,
+        experimental: {
+          openAPI: process.env.NODE_ENV === 'development',
+        },
       },
       runtimeConfig: {
         public: {
@@ -144,6 +176,17 @@ export default defineNuxtConfig(
       security: {
         headers: {
           contentSecurityPolicy: defu(
+            {
+              // Cloudflare
+              ...(process.env.NODE_ENV === 'production'
+                ? {
+                    'connect-src': ["'self'"], // `${SITE_URL}/cdn-cgi/rum`
+                    'script-src-elem': [
+                      'https://static.cloudflareinsights.com',
+                    ],
+                  }
+                : {}),
+            },
             {
               // Google Analytics 4 (https://developers.google.com/tag-platform/tag-manager/web/csp)
               'connect-src': [
@@ -159,6 +202,7 @@ export default defineNuxtConfig(
             },
             {
               // vio
+              'connect-src': ["'self'"], // `${SITE_URL}/api/healthcheck`
               'manifest-src': [`${SITE_URL}/site.webmanifest`],
               'script-src-elem': [
                 'https://polyfill.io/v3/polyfill.min.js', // ESLint plugin compat
@@ -166,19 +210,36 @@ export default defineNuxtConfig(
             },
             {
               // @nuxt/devtools
-              'frame-src': [
-                ...(process.env.NODE_ENV === 'development'
-                  ? ['http://localhost:3000/__nuxt_devtools__/client/']
-                  : []),
-              ],
+              ...(process.env.NODE_ENV === 'development'
+                ? {
+                    'frame-src': [
+                      'http://localhost:3000/__nuxt_devtools__/client/',
+                    ],
+                  }
+                : {}),
             },
             {
               // nuxt-link-checker
-              'connect-src': [
-                ...(process.env.NODE_ENV === 'development'
-                  ? ['http://localhost:3000/api/__link_checker__/inspect']
-                  : []),
-              ],
+              ...(process.env.NODE_ENV === 'development'
+                ? {
+                    'connect-src': ["'self'"], // 'http://localhost:3000/api/__link_checker__/inspect'
+                  }
+                : {}),
+            },
+            {
+              // nuxt-og-image
+              ...(process.env.NODE_ENV === 'development'
+                ? {
+                    'font-src': ['https://fonts.gstatic.com/s/inter/'],
+                    'frame-ancestors': ["'self'"],
+                    'frame-src': ["'self'"],
+                    'script-src-elem': ['https://cdn.tailwindcss.com/'],
+                    'style-src': [
+                      // TODO: replace with `style-src-elem` once Webkit supports it
+                      'https://cdn.jsdelivr.net/npm/gardevoir https://fonts.googleapis.com/css2',
+                    ],
+                  }
+                : {}),
             },
             {
               // nuxt-simple-sitemap
@@ -189,12 +250,12 @@ export default defineNuxtConfig(
               'connect-src': [
                 ...(process.env.NODE_ENV === 'development'
                   ? [
-                      'http://localhost:3000/_nuxt/', // Nuxt development
-                      'https://localhost:3000/_nuxt/', // Nuxt development
-                      'ws://localhost:3000/_nuxt/', // Nuxt development
-                      'wss://localhost:3000/_nuxt/', // Nuxt development
+                      'http://localhost:3000/_nuxt/', // hot reload
+                      'https://localhost:3000/_nuxt/', // hot reload
+                      'ws://localhost:3000/_nuxt/', // hot reload
+                      'wss://localhost:3000/_nuxt/', // hot reload
                     ]
-                  : ["'self'"]), // Nuxt build metadata and payloads
+                  : ["'self'"]), // build metadata and payloads
               ],
               'img-src': [
                 "'self'", // TODO: replace with `"'nonce-{{nonce}}'",`
@@ -207,6 +268,18 @@ export default defineNuxtConfig(
                 "'unsafe-inline'", // TODO: replace with `"'nonce-{{nonce}}'",` (https://github.com/vitejs/vite/pull/11864)
               ],
             },
+            {
+              // nitro
+              'connect-src': ["'self'"] /* swagger
+              'http://localhost:3000/_nitro/openapi.json',
+              'http://localhost:3000/_nitro/swagger', */,
+              'script-src-elem': [
+                'https://cdn.jsdelivr.net/npm/', // swagger // TODO: increase precision (https://github.com/unjs/nitro/issues/1757)
+              ],
+              'style-src': [
+                'https://cdn.jsdelivr.net/npm/', // swagger // TODO: increase precision (https://github.com/unjs/nitro/issues/1757)
+              ],
+            },
             {
               // base
               'base-uri': ["'none'"], // does not fallback to `default-src`
@@ -224,6 +297,8 @@ export default defineNuxtConfig(
               'prefetch-src': [],
               'report-to': [],
               'report-uri': [],
+              // TODO: evaluate header (https://github.com/maevsi/maevsi/issues/830) // https://stackoverflow.com/questions/62081028/this-document-requires-trustedscripturl-assignment
+              // 'require-trusted-types-for': ["'script'"], // csp-evaluator
               sandbox: [],
               'script-src': [],
               'script-src-attr': [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dargmuesli/nuxt-vio",
-  "version": "8.3.3",
+  "version": "8.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/dargmuesli/vio.git"
@@ -105,7 +105,6 @@
     "eslint-plugin-prettier": "5.0.1",
     "eslint-plugin-yml": "1.10.0",
     "h3": "1.8.2",
-    "is-https": "4.0.0",
     "jiti": "1.20.0",
     "jose": "4.15.4",
     "lint-staged": "15.0.2",

package/server/api/healthcheck.get.ts

@@ -1,5 +1,3 @@
-import { defineEventHandler } from 'h3'
-
 export default defineEventHandler((event) => {
   const { res } = event.node
   res.setHeader('Content-Type', 'text/plain')

package/server/middleware/headers.ts

@@ -1,10 +1,6 @@
-import { appendHeader, defineEventHandler } from 'h3'
 import type { H3Event } from 'h3'
 import type { AppConfig } from 'nuxt/schema'
 
-import { TIMEZONE_HEADER_KEY } from '../../utils/constants'
-import { getTimezone } from '../../utils/networking'
-
 export default defineEventHandler(async (event) => {
   setRequestHeader(event, TIMEZONE_HEADER_KEY, await getTimezone(event))
   setResponseHeaders(event)

package/server/utils/util.ts

@@ -0,0 +1,2 @@
+export { TIMEZONE_HEADER_KEY } from '../../utils/constants'
+export { getTimezone } from '../../utils/networking'