From 9b053e1648ae23a8a73c510d7fece40c09f9c66d Mon Sep 17 00:00:00 2001 From: ralksta Date: Fri, 29 May 2026 17:09:53 +0200 Subject: [PATCH] fix: exclude /admin from CSP middleware to prevent script blocking The admin panel is a static page with client-side React that gets prerendered at build time. The nonce-based CSP from middleware doesn't work for static pages because the nonce is generated per-request but the HTML is served from cache without it. Exclude /admin from the middleware matcher so its scripts can load normally. --- middleware.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/middleware.ts b/middleware.ts index 1ac3523..1810f36 100644 --- a/middleware.ts +++ b/middleware.ts @@ -43,12 +43,13 @@ export const config = { /* * Match all request paths except for the ones starting with: * - api (API routes) + * - admin (admin panel — static page, manages its own security) * - _next/static (static files) * - _next/image (image optimization files) * - favicon.ico, sitemap.xml, robots.txt (metadata files) */ { - source: '/((?!api|_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt).*)', + source: '/((?!api|admin|_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt).*)', missing: [ { type: 'header', key: 'next-router-prefetch' }, { type: 'header', key: 'purpose', value: 'prefetch' },