middleware.ts

importtype{NextRequest}from'next/server'
import{NextResponse}from'next/server'

constNECESSARY_DOMAIN='*.sentry.io http://localhost:* http://127.0.0.1:* https://analytics.google.com googletagmanager.com *.googletagmanager.com https://www.google-analytics.com https://api.github.com'

constwrapResponseWithXFrameOptions=(response: NextResponse,pathname: string)=>{
// prevent clickjacking: https://owasp.org/www-community/attacks/Clickjacking
// Chatbot page should be allowed to be embedded in iframe. It's a feature
if(process.env.NEXT_PUBLIC_ALLOW_EMBED!=='true'&&!pathname.startsWith('/chat')&&!pathname.startsWith('/workflow')&&!pathname.startsWith('/completion'))
response.headers.set('X-Frame-Options','DENY')

returnresponse
}
exportfunctionmiddleware(request: NextRequest){
const{ pathname }=request.nextUrl
constrequestHeaders=newHeaders(request.headers)
constresponse=NextResponse.next({
request: {
headers: requestHeaders,
},
})

constisWhiteListEnabled=!!process.env.NEXT_PUBLIC_CSP_WHITELIST&&process.env.NODE_ENV==='production'
if(!isWhiteListEnabled)
returnwrapResponseWithXFrameOptions(response,pathname)

constwhiteList=`${process.env.NEXT_PUBLIC_CSP_WHITELIST}${NECESSARY_DOMAIN}`
constnonce=Buffer.from(crypto.randomUUID()).toString('base64')
constcsp=`'nonce-${nonce}'`

constscheme_source='data: mediastream: blob: filesystem:'

constcspHeader=`
 default-src 'self' ${scheme_source}${csp}${whiteList};
 connect-src 'self' ${scheme_source}${csp}${whiteList};
 script-src 'self' ${scheme_source}${csp}${whiteList};
 style-src 'self' 'unsafe-inline' ${scheme_source}${whiteList};
 worker-src 'self' ${scheme_source}${csp}${whiteList};
 media-src 'self' ${scheme_source}${csp}${whiteList};
 img-src 'self' ${scheme_source}${csp}${whiteList};
 font-src 'self';
 object-src 'none';
 base-uri 'self';
 form-action 'self';
 upgrade-insecure-requests;
`
// Replace newline characters and spaces
constcontentSecurityPolicyHeaderValue=cspHeader
.replace(/\s{2,}/g,' ')
.trim()

requestHeaders.set('x-nonce',nonce)

requestHeaders.set(
'Content-Security-Policy',
contentSecurityPolicyHeaderValue,
)

response.headers.set(
'Content-Security-Policy',
contentSecurityPolicyHeaderValue,
)

returnwrapResponseWithXFrameOptions(response,pathname)
}

exportconstconfig={
matcher: [
/*
 * Match all request paths except for the ones starting with:
 * - api (API routes)
 * - _next/static (static files)
 * - _next/image (image optimization files)
 * - favicon.ico (favicon file)
 */
{
// source: '/((?!api|_next/static|_next/image|favicon.ico).*)',
source: '/((?!_next/static|_next/image|favicon.ico).*)',
// source: '/(.*)',
// missing: [
// { type: 'header', key: 'next-router-prefetch' },
// { type: 'header', key: 'purpose', value: 'prefetch' },
// ],
},
],
}