From 36d4da7a680546c3d67fba5b63fba09a0f1bf4e0 Mon Sep 17 00:00:00 2001 From: Gandalf Date: Wed, 7 Jan 2026 21:23:14 +0100 Subject: [PATCH] Disable nonce-based CSP in middleware Next.js 14 doesn't fully support nonce-based CSP: - Internal scripts (__NEXT_DATA__, hydration) don't receive nonces automatically - Inline style attributes (style-src-attr) don't support nonces at all The static CSP in next.config.js provides protection without causing violations. See #796 for tracking nonce CSP support in future Next.js versions. --- apps/blog/app/layout.tsx | 16 ++--------- apps/blog/middleware.ts | 62 +++++----------------------------------- 2 files changed, 9 insertions(+), 69 deletions(-) diff --git a/apps/blog/app/layout.tsx b/apps/blog/app/layout.tsx index 66710cba7..9575e635a 100644 --- a/apps/blog/app/layout.tsx +++ b/apps/blog/app/layout.tsx @@ -2,7 +2,7 @@ import '@hive/tailwindcss-config/globals.css'; import { ReactNode } from 'react'; import Script from 'next/script'; import { Metadata } from 'next'; -import { cookies, headers } from 'next/headers'; +import { cookies } from 'next/headers'; import MainBar from '../features/layouts/site-header/main-bar'; import ClientEffects from '../features/layouts/site-header/client-effects'; import { Providers } from '../features/layouts/providers'; @@ -11,15 +11,6 @@ import VisitLoggerClient from '../lib/visit-logger-client'; // Get basePath from build-time environment const basePath = process.env.NEXT_PUBLIC_BASE_PATH || ''; -/** - * Get the CSP nonce from the request headers. - * The nonce is generated in middleware and passed via x-nonce header. - */ -function getNonce(): string { - const headersList = headers(); - return headersList.get('x-nonce') || ''; -} - const SITE_DESC = 'Communities without borders. A social network owned and operated by its users, powered by Hive.'; @@ -57,9 +48,6 @@ export default async function RootLayout({ children }: { children: ReactNode }) const locale = cookieStore.get('NEXT_LOCALE')?.value || 'en'; const isRTL = locale === 'ar'; - // Get nonce for CSP-compliant script loading - const nonce = getNonce(); - return ( @@ -72,7 +60,7 @@ export default async function RootLayout({ children }: { children: ReactNode }) -