e0c1814cf1
The /minio-images rewrite proxied straight onto the MinIO bucket with no authentication, and the bucket carries an anonymous read policy. Verified from the public internet: GET /minio-images?list-type=2 returned a full ListBucketResult naming all 33 objects, and any key then fetched 200. Every menu scan, drink photo and bar photo was enumerable and downloadable by anyone. Replaced with a route handler that requires a session and streams via the existing getImage(). The URL shape is unchanged, so stored imageUrls, uploadImage/getImageUrl and every <img> keep working. Nothing uses next/image and it must stay that way here: the optimizer fetches server-side without the session cookie. Route protection was an allowlist that had to be updated by hand for each new page, and had already been missed for /bar, /bartender and /recommend, which rendered to logged-out visitors. /recipes was in the middleware matcher but not the authorized() list, so it fell through too. Inverted both to a denylist so new pages are private by default. /api stays out of the matcher because authorized() answers with an HTML redirect and API clients need the JSON 401 those routes already return. Also fixes a cross-user write: POST /api/recipes took sourceDrinkId from the client with no ownership check, and the drink detail page loaded its recipes relation unfiltered, so one user could attach an arbitrary recipe to another user's drink where it rendered permanently and the owner could not delete it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
66 lines
2.2 KiB
JavaScript
66 lines
2.2 KiB
JavaScript
/** @type {import('next').NextConfig} */
|
|
const nextConfig = {
|
|
output: "standalone",
|
|
// No `images.remotePatterns` and no rewrite to MinIO: images are served by the
|
|
// session-gated route at src/app/minio-images/[...key]/route.ts. The rewrite this
|
|
// replaced was an unauthenticated proxy onto the bucket. Nothing uses next/image,
|
|
// and it must stay that way - the optimizer fetches without the session cookie.
|
|
async headers() {
|
|
return [
|
|
{
|
|
source: "/(.*)",
|
|
headers: [
|
|
{
|
|
key: "X-Frame-Options",
|
|
value: "DENY",
|
|
},
|
|
{
|
|
key: "X-Content-Type-Options",
|
|
value: "nosniff",
|
|
},
|
|
{
|
|
key: "Referrer-Policy",
|
|
value: "strict-origin-when-cross-origin",
|
|
},
|
|
{
|
|
key: "X-DNS-Prefetch-Control",
|
|
value: "on",
|
|
},
|
|
{
|
|
key: "Strict-Transport-Security",
|
|
value: "max-age=63072000; includeSubDomains; preload",
|
|
},
|
|
{
|
|
key: "Permissions-Policy",
|
|
value: "camera=(self), microphone=(), geolocation=(), interest-cohort=()",
|
|
},
|
|
{
|
|
key: "Content-Security-Policy",
|
|
value: [
|
|
"default-src 'self'",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
// Product and drink images are mirrored into our own storage and served
|
|
// from 'self' via /minio-images, so third-party image hosts do not belong
|
|
// here. The exceptions are OAuth avatars, which the provider hosts and we
|
|
// only ever receive as a URL at sign-in.
|
|
[
|
|
"img-src 'self' data: blob:",
|
|
"https://lh3.googleusercontent.com",
|
|
"https://avatars.githubusercontent.com",
|
|
].join(" "),
|
|
"font-src 'self'",
|
|
"connect-src 'self'",
|
|
"frame-ancestors 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
].join("; "),
|
|
},
|
|
],
|
|
},
|
|
];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|