till
dd8061d838
CI / check (push) Has been cancelled
Astro 7 moved `csp` out of `experimental` — but to `security.csp`, not to the top level, and I put it at the top level. Astro's config schema drops keys it does not know without a word: the build stayed green, the types stayed green, and every response went out with no Content-Security-Policy at all. Only looking at a live response header showed it. Fixed, and now guarded: tests/config.test.ts reads the config and asserts the policy sits where Astro actually reads it. Checked that the test goes red against the broken config before trusting it green against this one. Verified on a running instance: the header is back, with the same per-script hashes as before.
43 lines
1.5 KiB
JavaScript
43 lines
1.5 KiB
JavaScript
import { defineConfig } from 'astro/config';
|
|
import node from '@astrojs/node';
|
|
import react from '@astrojs/react';
|
|
|
|
// Klarbild runs as a Node server (SSR) with an in-process queue.
|
|
export default defineConfig({
|
|
output: 'server',
|
|
adapter: node({ mode: 'standalone' }),
|
|
integrations: [react()],
|
|
// CSRF: handled by our own SameSite=Lax session cookie. Astro's checkOrigin
|
|
// breaks multipart uploads behind a reverse proxy, because the proxy speaks
|
|
// http to the app while the browser spoke https and the origins no longer match.
|
|
//
|
|
// Content-Security-Policy with hashes instead of 'unsafe-inline': Astro computes
|
|
// the hash of every inline script and style it emits, at build time. The remaining
|
|
// directives are set by the middleware (src/middleware.ts).
|
|
// Astro 7 graduated this out of `experimental` and it lives under `security` now.
|
|
// Careful: a top-level `csp` key is swallowed without a warning and the site then
|
|
// runs with no policy at all.
|
|
security: {
|
|
checkOrigin: false,
|
|
csp: {
|
|
directives: [
|
|
"default-src 'self'",
|
|
"img-src 'self' data: blob:",
|
|
"font-src 'self'",
|
|
"connect-src 'self'",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-ancestors 'none'",
|
|
],
|
|
},
|
|
},
|
|
server: { host: true, port: Number(process.env.PORT) || 4321 },
|
|
vite: {
|
|
ssr: {
|
|
// Do not bundle native modules
|
|
external: ['sharp', 'argon2', 'pg', 'pg-boss', 'ssh2-sftp-client', 'basic-ftp', 'heic-convert'],
|
|
},
|
|
},
|
|
});
|