https://nextjs.org/docs/app/guides/content-security-policy

TODO:
* https://www.crowdsec.net/ - 알려진 악성 IP 자동 차단

next.config.ts

@@ -1,7 +1,36 @@
-import type { NextConfig } from "next";
+import type { NextConfig } from 'next';
+
+const isDev = process.env.NODE_ENV === 'development';
+
+const cspHeader = `
+    default-src 'self';
+    connect-src 'self' https://api.bitdori.org wss://api.bitdori.org;
+    script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ''};
+    style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
+    img-src 'self' blob: data:;
+    font-src 'self' https://fonts.gstatic.com;
+    object-src 'none';
+    base-uri 'self';
+    form-action 'self';
+    frame-ancestors 'none';
+    upgrade-insecure-requests;
+`;
 
 const nextConfig: NextConfig = {
   /* config options here */
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: cspHeader.replaceAll(/\n/g, ''),
+          },
+        ],
+      },
+    ];
+  },
 };
 
 export default nextConfig;