Move header back to next config

next.config.js

@@ -4,6 +4,35 @@ const { version } = require('./package.json')
 
 const isDev = process.env.NODE_ENV !== 'production'
 
+const CONNECT_SRC_HOSTS = [
+  'https://*.celo.org',
+  'https://*.celoscan.io',
+  'https://*.walletconnect.com',
+  'wss://*.walletconnect.com',
+  'wss://*.walletconnect.org',
+  'https://raw.githubusercontent.com',
+  'https://celo-mainnet.infura.io',
+];
+const FRAME_SRC_HOSTS = ['https://*.walletconnect.com', 'https://*.walletconnect.org'];
+const IMG_SRC_HOSTS = ['https://raw.githubusercontent.com', 'https://*.walletconnect.com'];
+
+const cspHeader = `
+  default-src 'self';
+  script-src 'self'${isDev ? " 'unsafe-eval'" : ''};
+  script-src-elem 'self' 'unsafe-inline';
+  style-src 'self' 'unsafe-inline';
+  connect-src 'self' ${CONNECT_SRC_HOSTS.join(' ')};
+  img-src 'self' blob: data: ${IMG_SRC_HOSTS.join(' ')};
+  font-src 'self' data:;
+  object-src 'none';
+  base-uri 'self';
+  form-action 'self';
+  frame-src 'self' ${FRAME_SRC_HOSTS.join(' ')};
+  frame-ancestors 'none';
+  ${!isDev ? 'block-all-mixed-content;' : ''}
+  ${!isDev ? 'upgrade-insecure-requests;' : ''}
+`.replace(/\s{2,}/g, ' ').trim()
+
 const securityHeaders = [
   {
     key: 'X-XSS-Protection',
@@ -21,12 +50,10 @@ const securityHeaders = [
     key: 'Referrer-Policy',
     value: 'strict-origin-when-cross-origin',
   },
-  // {
-  //   // Note: This is a fallback default CSP.
-  //   // See middleware.ts for the actual CSP
-  //   key: 'Content-Security-Policy',
-  //   value: `default-src 'self';`,
-  // },
+  {
+    key: 'Content-Security-Policy',
+    value: cspHeader,
+  },
 ]
 
 module.exports = {