mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-22 07:24:26 +00:00
d27833e1bc
# Which Problems Are Solved This PR introduces robust redirect configuration options and enhances security for Server Actions in multi-domain setups. # How the Problems Are Solved - Redirect Fallback Logic: Implemented a unified `resolveRedirectUri` utility that prioritizes redirect targets as follows: - Environment override (`DEFAULT_REDIRECT_URI`) - Organization settings (`defaultRedirectUri`). - Relative fallback (`/signedin?...`). - Host Reflection: `DEFAULT_REDIRECT_URI` supports absolute URLs or relative paths via host reflection. - Server Action Security: Configured `serverActions.allowedOrigins` to be dynamically manageable via the `SERVER_ACTION_ALLOWED_ORIGINS` environment variable (comma-separated list). It defaults to an empty list for maximum security. - UI Integration: Updated the /signedin page to use the unified redirect logic, ensuring consistent behavior for the "Continue" button. - Documentation: Added type definitions and detailed descriptions for new environment variables in `next-env-vars.d.ts` --------- Co-authored-by: Copilot <[email protected]>
64 lines
1.5 KiB
JavaScript
Executable File
64 lines
1.5 KiB
JavaScript
Executable File
import createNextIntlPlugin from "next-intl/plugin";
|
|
import { DEFAULT_CSP } from "./constants/csp.js";
|
|
|
|
const withNextIntl = createNextIntlPlugin();
|
|
|
|
const secureHeaders = [
|
|
{
|
|
key: "Strict-Transport-Security",
|
|
value: "max-age=63072000; includeSubDomains; preload",
|
|
},
|
|
{
|
|
key: "Referrer-Policy",
|
|
value: "origin-when-cross-origin",
|
|
},
|
|
{
|
|
key: "X-Content-Type-Options",
|
|
value: "nosniff",
|
|
},
|
|
{
|
|
key: "X-XSS-Protection",
|
|
value: "1; mode=block",
|
|
},
|
|
{
|
|
key: "Content-Security-Policy",
|
|
value: DEFAULT_CSP,
|
|
},
|
|
{ key: "X-Frame-Options", value: "deny" },
|
|
];
|
|
|
|
/** @type {import('next').NextConfig} */
|
|
const nextConfig = {
|
|
basePath: process.env.NEXT_PUBLIC_BASE_PATH,
|
|
output: process.env.NEXT_OUTPUT_MODE || undefined,
|
|
reactStrictMode: true,
|
|
experimental: {
|
|
// Add React 19 compatibility optimizations
|
|
optimizePackageImports: ["@radix-ui/react-tooltip", "@heroicons/react"],
|
|
useCache: true,
|
|
serverActions: {
|
|
...(process.env.SERVER_ACTION_ALLOWED_ORIGINS
|
|
? { allowedOrigins: process.env.SERVER_ACTION_ALLOWED_ORIGINS.split(",").map((o) => o.trim()) }
|
|
: {}),
|
|
},
|
|
},
|
|
|
|
// Improve SSR stability - not actually needed for React 19 SSR issues
|
|
// onDemandEntries: {
|
|
// maxInactiveAge: 25 * 1000,
|
|
// pagesBufferLength: 2,
|
|
// },
|
|
// Better error handling for production builds
|
|
poweredByHeader: false,
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: "/:path*",
|
|
headers: secureHeaders,
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default withNextIntl(nextConfig);
|