@@ -314,6 +314,21 @@ const securityHeadersConfig = (phase: string) => {
314
314
${ upgradeInsecure }
315
315
`
316
316
317
+ // for production environment white-list vitals.vercel-insights
318
+ // based on: https://vercel.com/docs/speed-insights#content-security-policy
319
+ if ( process . env . VERCEL_ENV === 'production' ) {
320
+ return `
321
+ ${ defaultCSPDirectives }
322
+ font-src 'self';
323
+ style-src 'self' 'unsafe-inline';
324
+ script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
325
+ connect-src 'self' https://vitals.vercel-insights.com ${ reportingDomainWildcard } ;
326
+ img-src 'self' data:;
327
+ frame-src 'none';
328
+ ${ reportCSPViolations }
329
+ `
330
+ }
331
+
317
332
// when environment is preview enable unsafe-inline scripts for vercel preview feedback/comments feature
318
333
// and whitelist vercel's domains based on:
319
334
// https://vercel.com/docs/workflow-collaboration/comments/specialized-usage#using-a-content-security-policy
@@ -332,26 +347,11 @@ const securityHeadersConfig = (phase: string) => {
332
347
`
333
348
}
334
349
335
- // for production environment white-list vitals.vercel-insights
336
- // based on: https://vercel.com/docs/speed-insights#content-security-policy
337
- if ( process . env . VERCEL_ENV === 'production' ) {
338
- return `
339
- ${ defaultCSPDirectives }
340
- font-src 'self';
341
- style-src 'self' 'unsafe-inline';
342
- script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
343
- connect-src 'self' https://vitals.vercel-insights.com ${ reportingDomainWildcard } ;
344
- img-src 'self' data:;
345
- frame-src 'none';
346
- ${ reportCSPViolations }
347
- `
348
- }
349
-
350
350
// for dev environment enable unsafe-eval for hot-reload
351
351
return `
352
352
${ defaultCSPDirectives }
353
- font-src 'self';
354
- style-src 'self' 'unsafe-inline';
353
+ font-src 'self' https://fonts.gstatic.com ;
354
+ style-src 'self' 'unsafe-inline' https://fonts.googleapis.com ;
355
355
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com;
356
356
connect-src 'self';
357
357
img-src 'self' data:;
@@ -432,14 +432,26 @@ export default withSentryConfig(
432
432
enabled : false ,
433
433
} ,
434
434
435
+ // TODO: enable as soon as @sentry /nextjs supports it
436
+ // (and set the above reactComponentAnnotation to true)
437
+ // https://github.com/getsentry/sentry-javascript/releases
438
+ // ignore the "Canvas" component to avoid Sentry annotations
439
+ // conflicts with react-three-fiber
440
+ //ignoredComponents: ['Canvas'],
441
+
435
442
// Route browser requests to Sentry through a Next.js rewrite to circumvent ad-blockers.
436
443
// This can increase your server load as well as your hosting bill.
437
444
// Note: Check that the configured route will not match with your Next.js middleware, otherwise reporting of client-
438
445
// side errors will fail.
439
446
tunnelRoute : '/monitoring' ,
440
447
441
448
// Hides source maps from generated client bundles
442
- hideSourceMaps : true ,
449
+ sourcemaps : {
450
+ //disable: false;
451
+ //assets: string | string[];
452
+ //ignore?: string | string[];
453
+ //deleteSourcemapsAfterUpload: boolean;
454
+ } ,
443
455
444
456
// Automatically tree-shake Sentry logger statements to reduce bundle size
445
457
disableLogger : true ,
0 commit comments