You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To modify these default settings and further increase the security of your application, read about our `strict` mode and our user-friendly approach on how to [Improve Security](/documentation/advanced/improve-security)
127
+
To modify these default settings and further increase the security of your application, read about our `strict` mode and our user-friendly approach on how to [Improve Security](/advanced/improve-security)
Copy file name to clipboardexpand all lines: docs/content/2.headers/1.csp.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -133,7 +133,7 @@ type CSPSandboxValue =
133
133
134
134
Nuxt Security helps you increase the security of your site by enabling **Strict CSP** support for both SSR and SSG applications.
135
135
136
-
For further reading about Strict CSP and how to handle specific cases, please consult our [Adanced Section about Strict CSP](/documentation/advanced/strict-csp)
136
+
For further reading about Strict CSP and how to handle specific cases, please consult our [Adanced Section about Strict CSP](/advanced/strict-csp)
137
137
138
138
- For SSR applications, Nuxt Security implements strict CSP via nonces. A one-time cryptographically-generated random nonce is generated at runtime by the server for each request of a page.
139
139
- For SSG applications, Nuxt Security implements strict CSP via hashes. At static build-time, Nuxt Security computes the SHA hashes of the elements that are allowed to execute on your site.
@@ -287,7 +287,7 @@ Our default recommendation is to avoid setting the `ssg: hashStyles` option to `
287
287
<br>
288
288
⚠ This is because Nuxt's mechanism for Client-Side hydration of styles could be blocked by CSP in that case.
289
289
<br>
290
-
For further discussion and alternatives, please refer to our [Advanced Section on CSP](/documentation/advanced/strict-csp).
290
+
For further discussion and alternatives, please refer to our [Advanced Section on CSP](/advanced/strict-csp).
291
291
::
292
292
293
293
::callout{icon="i-heroicons-light-bulb"}
@@ -356,7 +356,7 @@ You can include any external script (Google Analytics, Stripe, Cloudflare Turnst
356
356
::callout{icon="i-heroicons-light-bulb"}
357
357
You will need to have default values for the `'strict-dynamic'`, `nonce` and `ssg` options.
358
358
<br>
359
-
If you change these default values, please refer to our [Advanced Section on CSP](/documentation/advanced/strict-csp) for alternatives.
359
+
If you change these default values, please refer to our [Advanced Section on CSP](/advanced/strict-csp) for alternatives.
360
360
::
361
361
362
362
- Since Nuxt 3.11, the easiest and universal way to include external scripts is via `useScript`
Copy file name to clipboardexpand all lines: docs/content/4.utils/3.subresource-integrity.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -69,7 +69,7 @@ SRI is supported by all modern browsers: [caniuse](https://caniuse.com/subresour
69
69
70
70
**2. SRI is a critical component of Content Security Policy (CSP) in SSG mode.**
71
71
72
-
For more information on the relationship between Subresource Integrity and a Strict CSP, please read our [Advanced Section on Integrity Hashes for CSP](/documentation/advanced/strict-csp/#ssg-mode)
72
+
For more information on the relationship between Subresource Integrity and a Strict CSP, please read our [Advanced Section on Integrity Hashes for CSP](/advanced/strict-csp/#ssg-mode)
73
73
74
74
If you use CSP on a statically-generated application, you will need to enable SRI by setting `sri: true`.
Copy file name to clipboardexpand all lines: docs/content/5.advanced/3.strict-csp.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -684,7 +684,7 @@ Nuxt Security allows you to generate your own headers rules with the `nuxt-secur
684
684
685
685
If you do not deploy with a Nitro preset, or if you have specific requirements that are not met by the `ssg: exportToPresets` default, you can use this hook to generate your headers configuration file yourself.
686
686
687
-
See our documentation on the [prerenderedPages hook](/documentation/advanced/hooks/#prerendered-headers-hook)
687
+
See our documentation on the [prerenderedPages hook](/advanced/hooks/#prerendered-headers-hook)
688
688
689
689
::callout{icon="i-heroicons-light-bulb"}
690
690
This will allow you to deliver CSP via HTTP headers, in addition to the standard `<meta http-equiv>` approach.
@@ -717,7 +717,7 @@ These considerations are equally true for SSR (where the server needs to be hit
If you implement per-route CSP, you will need to enforce an external reload upon navigation for the new CSP to enter into action.
719
719
<br>
720
-
Please see our FAQ section on [Updating Headers on a specific route](/documentation/advanced/faq/#updating-headers-on-a-specific-route)
720
+
Please see our FAQ section on [Updating Headers on a specific route](/advanced/faq/#updating-headers-on-a-specific-route)
721
721
::
722
722
723
723
::callout{icon="i-heroicons-light-bulb"}
@@ -731,4 +731,4 @@ In order to obtain a Strict CSP on Nuxt apps, we need to use `strict-dynamic`. T
731
731
732
732
On the other hand, it obliges application developers to adopt a standardized mindset when thinking about CSP. Less configuration options means less potential loopholes that malicious actors can seek to exploit.
733
733
734
-
With this in mind, we recommend that you implement your Strict CSP policy by starting from our [default configuration values](/documentation/getting-started/configuration#default), and modifying only the required values.
734
+
With this in mind, we recommend that you implement your Strict CSP policy by starting from our [default configuration values](/getting-started/configuration#default), and modifying only the required values.
Copy file name to clipboardexpand all lines: docs/content/5.advanced/7.improve-security.md
+10-10
Original file line number
Diff line number
Diff line change
@@ -39,23 +39,23 @@ The most common issues usually fall into one these categories:
39
39
40
40
In most cases, this is because you have included an external script in an 'unconventional' way, which is unrecognized by the Content Security Policy settings for the `script-src` directive.
41
41
42
-
Our recommendation is to always include external scripts via `useScript` and we provide a detailed section on [Including External Scripts](/documentation/headers/csp#including-external-scripts).
42
+
Our recommendation is to always include external scripts via `useScript` and we provide a detailed section on [Including External Scripts](/headers/csp#including-external-scripts).
43
43
44
44
This scenario can also happen if your hosting provider messes with your code. See below.
45
45
46
46
**2. An image or video is blocked**
47
47
48
48
By default, Nuxt Security requires you to whitelist your external media sources. For security reasons, the Content Security Policy settings of the `img-src` directive only allows you to include self-hosted files.
49
49
50
-
If you need to include external media from third-party sites, please refer to our documentation on [Whitelisting External Resources](/documentation/advanced/faq#allowing-images-and-scripts-from-external-domains).
50
+
If you need to include external media from third-party sites, please refer to our documentation on [Whitelisting External Resources](/advanced/faq#allowing-images-and-scripts-from-external-domains).
51
51
52
52
This scenario can also happen if your hosting provider messes with your code. See below.
53
53
54
54
**3. A frame is blocked**
55
55
56
56
In the vast majority of cases, this is due to Cross Origin Isolation restrictions on third-party frames. For maximum compatibility, Nuxt Security applies the `credentialless` policy to the COEP header. However, some third-party resources are incompatible with COEP/COOP requirements, which is beyond your control.
57
57
58
-
In that case, please follow our instructions on [Cross-Origin Isolation Issues](/documentation/headers/crossoriginembedderpolicy#cross-origin-isolation-issues).
58
+
In that case, please follow our instructions on [Cross-Origin Isolation Issues](/headers/crossoriginembedderpolicy#cross-origin-isolation-issues).
59
59
60
60
This scenario can also happen if your hosting provider messes with your code. See below.
61
61
@@ -64,23 +64,23 @@ The most common issues usually fall into one these categories:
64
64
Some hosting providers will modify your code upon deployment. Usually this is intended to minify your files, or to inject trackers that provide additional services. By default, Nuxt Security will detect that your code has been modified and our Content Security Policy will block the application from running.
65
65
66
66
Please make sure that you disable all Post-Build Modification services that may be applied by your hosting platform. You can refer to our resources here:
-[An example for Cloudflare](/advanced/faq#cloudflare).
69
69
70
70
**5. Camera, microphone, etc. access is denied**
71
71
72
72
By default, Nuxt Security sets Permissions Policies that protect your users against unintended image, sound, location or screen captures.
73
73
74
-
If your application requires using one of these features, please modify your [Permission Policies](/documentation/headers/permissions-policy).
74
+
If your application requires using one of these features, please modify your [Permission Policies](/headers/permissions-policy).
75
75
76
76
**6. SSL, TLS, and other HTTPS denials**
77
77
78
78
You will face this issue if you are trying to connect to non-HTTPS resources. This happen because Nuxt Security makes sure that only secure, encrypted connections are allowed, via both its `upgrade-insecure-requests` Content Security Policy, and its `strictTransportSecurity` settings.
79
79
80
80
In general, you should not connect to non-HTTPS resources. If you need to disable SSL upgrading in development mode, we provide instructions on several standard use cases:
81
-
-[Running with --host flag](/documentation/advanced/faq#running-app-with-host-flag)
82
-
-[Hot Reload during development](/documentation/headers/csp#hot-reload-during-development)
@@ -224,7 +224,7 @@ These settings enforce two additional security measures in relation to iframes:
224
224
1. You will only be able to embed external frames that are individually whitelisted in the `frame-src` directive
225
225
2. Any such frame will be cross-origin isolated, due to the application of the `require-corp` COEP value
226
226
227
-
Cross-origin isolation requires the embedded frame to be delivered with matching COEP/COOP headers. Your browser's Developer Tools will tell you if it's not the case. Please refer to [Cross-Origin Isolation Issues](/documentation/headers/crossoriginembedderpolicy#cross-origin-isolation-issues) for remediation solutions.
227
+
Cross-origin isolation requires the embedded frame to be delivered with matching COEP/COOP headers. Your browser's Developer Tools will tell you if it's not the case. Please refer to [Cross-Origin Isolation Issues](/headers/crossoriginembedderpolicy#cross-origin-isolation-issues) for remediation solutions.
0 commit comments