From 292c62f5e90b240c1a8e7172461525762b112cfb Mon Sep 17 00:00:00 2001
From: "Bitdori (Admin)" <admin@bitdori.org>
Date: Tue, 1 Sep 2026 21:08:40 +0900
Subject: [PATCH] https://nextjs.org/docs/app/guides/content-security-policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TODO:
* https://www.crowdsec.net/ - 알려진 악성 IP 자동 차단
---
 next.config.ts | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/next.config.ts b/next.config.ts
index e9ffa30..0085f44 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,7 +1,36 @@
-import type { NextConfig } from "next";
+import type { NextConfig } from 'next';
+
+const isDev = process.env.NODE_ENV === 'development';
+
+const cspHeader = `
+    default-src 'self';
+    connect-src 'self' https://api.bitdori.org wss://api.bitdori.org;
+    script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ''};
+    style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
+    img-src 'self' blob: data:;
+    font-src 'self' https://fonts.gstatic.com;
+    object-src 'none';
+    base-uri 'self';
+    form-action 'self';
+    frame-ancestors 'none';
+    upgrade-insecure-requests;
+`;
 
 const nextConfig: NextConfig = {
   /* config options here */
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: cspHeader.replaceAll(/\n/g, ''),
+          },
+        ],
+      },
+    ];
+  },
 };
 
 export default nextConfig;