CSP für Netlify konfigurieren

// netlify/edge-functions/csp-nonce.ts
import type { Context } from "https://edge.netlify.com";

export default async (request: Request, context: Context) => {
  const response = await context.next();
  const contentType = response.headers.get("content-type") || "";

  // Nur HTML-Responses verarbeiten
  if (!contentType.includes("text/html")) {
    return response;
  }

  // Nonce generieren
  const nonce = crypto.randomUUID().replace(/-/g, "");

  // HTML lesen und Nonce in Script-Tags einfügen
  let html = await response.text();
  html = html.replace(
    /<script(?![^>]*nonce)/g,
    `<script nonce="${nonce}"`
  );

  // CSP-Header mit Nonce setzen
  const csp = [
    "default-src 'self'",
    `script-src 'self' 'nonce-${nonce}'`,
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data:",
    "font-src 'self'",
    "object-src 'none'",
    "base-uri 'self'",
    "form-action 'self'",
    "frame-ancestors 'none'",
  ].join("; ");

  return new Response(html, {
    status: response.status,
    headers: {
      ...Object.fromEntries(response.headers),
      "Content-Security-Policy": csp,
      "Content-Type": "text/html; charset=utf-8",
    },
  });
};

export const config = { path: "/*" };