Integration von Content Security Policy Nonces über die Next.js-Headers-Middleware

import { NextResponse } from 'next/server';
 
export function middleware(request) {
  try {
    const nonce = Buffer.from(crypto.getRandomValues(new Uint8Array(16))).toString('base64');
    const cspHeader = `default-src 'self'; script-src 'self' 'nonce-${nonce}' 'strict-dynamic';`;
    const requestHeaders = new Headers(request.headers);
    requestHeaders.set('x-nonce', nonce);
    requestHeaders.set('Content-Security-Policy', cspHeader);
 
    const response = NextResponse.next({ request: { headers: requestHeaders } });
    response.headers.set('Content-Security-Policy', cspHeader);
    return response;
  } catch (error) {
    throw new Error(`CSP Nonce Generation Failed: ${error.message}`);
  }
}