Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: exclude /admin from CSP middleware to prevent script blocking

Browse Source 
The admin panel is a static page with client-side React that gets
prerendered at build time. The nonce-based CSP from middleware doesn't
work for static pages because the nonce is generated per-request but
the HTML is served from cache without it. Exclude /admin from the
middleware matcher so its scripts can load normally.
This commit is contained in:
ralksta
2026-05-29 17:09:53 +02:00
parent e723358514
commit 9b053e1648
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
middleware.ts
View File

@@ -43,12 +43,13 @@ export const config = {
/* /*
* Match all request paths except for the ones starting with: * Match all request paths except for the ones starting with:
* - api (API routes) * - api (API routes)
* - admin (admin panel — static page, manages its own security)
* - _next/static (static files) * - _next/static (static files)
* - _next/image (image optimization files) * - _next/image (image optimization files)
* - favicon.ico, sitemap.xml, robots.txt (metadata files) * - favicon.ico, sitemap.xml, robots.txt (metadata files)
*/ */
{ {
source: '/((?!api|_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt).*)', source: '/((?!api|admin|_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt).*)',
missing: [ missing: [
{ type: 'header', key: 'next-router-prefetch' }, { type: 'header', key: 'next-router-prefetch' },
{ type: 'header', key: 'purpose', value: 'prefetch' }, { type: 'header', key: 'purpose', value: 'prefetch' },