@djangocfg/nextjs 2.1.448 → 2.1.450

package/dist/config/index.d.mts

@@ -59,6 +59,17 @@ interface BaseNextConfigOptions {
      * Inlines `NEXT_PUBLIC_DPOP_ENABLED='true'` so the generated auth.ts activates.
      */
     dpop?: boolean;
+    /**
+     * Loosen the baseline CSP just enough for Stripe.js / Stripe Checkout &
+     * Elements to work. When true, the required Stripe origins are added to
+     * `script-src` (js.stripe.com — loads the SDK), `frame-src`
+     * (js.stripe.com + checkout.stripe.com — Elements/Checkout mount iframes)
+     * and `connect-src` (api.stripe.com — tokenization/confirm XHR). Without
+     * this, the browser blocks Stripe.js and the payment form never renders.
+     * Enable ONLY on apps that actually mount Stripe (e.g. the billing
+     * dashboard), so every other app keeps the tighter default. Default: false.
+     */
+    stripe?: boolean;
     /**
      * PWA configuration options
      * Set to false to disable PWA, or provide custom options

package/dist/config/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@djangocfg/nextjs",
-      version: "2.1.448",
+      version: "2.1.450",
       description: "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
       keywords: [
         "nextjs",
@@ -1395,17 +1395,22 @@ function createBaseNextConfig(options = {}) {
       ];
       const hasIframeAllowlist = !!options.allowIframeFrom && options.allowIframeFrom.length > 0;
       const frameAncestors = hasIframeAllowlist ? options.allowIframeFrom.includes("*") ? "*" : `'self' ${options.allowIframeFrom.join(" ")}` : "'none'";
-      const connectSrc = isDev ? "connect-src 'self' http: https: ws: wss:" : "connect-src 'self' https: wss:";
+      const stripeScript = options.stripe ? " https://js.stripe.com" : "";
+      const stripeConnect = options.stripe ? " https://api.stripe.com" : "";
+      const stripeFrame = options.stripe ? " https://js.stripe.com https://checkout.stripe.com" : "";
+      const connectSrc = isDev ? `connect-src 'self' http: https: ws: wss:${stripeConnect}` : `connect-src 'self' https: wss:${stripeConnect}`;
       const imgSrc = isDev ? "img-src 'self' data: blob: http: https:" : "img-src 'self' data: blob: https:";
       const cspDirectives = [
         "default-src 'self'",
         // Next.js requires inline + eval for its runtime/HMR. Tighten to nonces later.
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+        `script-src 'self' 'unsafe-inline' 'unsafe-eval'${stripeScript}`,
         "style-src 'self' 'unsafe-inline'",
         imgSrc,
         "font-src 'self' data:",
         // API/websocket calls go cross-origin to Django/Centrifugo.
         connectSrc,
+        // Stripe Elements/Checkout mount iframes; add their hosts when enabled.
+        `frame-src 'self'${stripeFrame}`,
         "object-src 'none'",
         "base-uri 'self'",
         "form-action 'self'",
@@ -1524,6 +1529,7 @@ function createBaseNextConfig(options = {}) {
     autoInstall,
     allowIframeFrom,
     dpop,
+    stripe,
     ...nextConfigOptions
   } = options;
   let finalConfig = deepMerge(baseConfig, nextConfigOptions);