From d75f681c8784246715b5d731bfa117dcda9b0c3e Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Tue, 18 Mar 2025 22:34:12 +0545
Subject: [PATCH] chore(security): Configure HTTP Security Headers (#7220)

Co-authored-by: Pablo Lara <larabjj@gmail.com>
---
 ui/next.config.js | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/ui/next.config.js b/ui/next.config.js
index b9f289635e..059659b2f0 100644
--- a/ui/next.config.js
+++ b/ui/next.config.js
@@ -1,4 +1,39 @@
 /** @type {import('next').NextConfig} */
+
+// HTTP Security Headers
+// 'unsafe-eval' is configured under `script-src` because it is required by NextJS for development mode
+const cspHeader = `
+    img-src 'self';
+    font-src 'self';
+    style-src 'self' 'unsafe-inline';
+    script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com;
+    connect-src 'self' https://api.iconify.design https://api.simplesvg.com https://api.unisvg.com https://js.stripe.com;
+    frame-src 'self' https://js.stripe.com/;
+    frame-ancestors 'none';
+    default-src 'self'
+`
+
 module.exports = {
   output: "standalone",
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: cspHeader.replace(/\n/g, ''),
+          },
+          {
+            key: 'X-Content-Type-Options',
+            value: 'nosniff',
+          },
+          {
+            key: 'Referrer-Policy',
+            value: 'strict-origin-when-cross-origin',
+          },
+        ],
+      },
+    ]
+  }
 };