AHMED
8e577165cf
- F2: per-IP rate limits on POST /api/users, /login, /forgot-password via new Next middleware (5/h signup, 10/15min login, 5/h forgot); 429 + Retry-After, generic Arabic error, no UX change - F7: ghost-email logins burn the same PBKDF2 cost (600k/32/sha256) as real verifies, closing response-time user enumeration - F4: HSTS max-age=63072000; includeSubDomains on all routes - F1: Traefik pagelimit (60/min, burst 120) + connlimit (in-flight 50) on the page router; apilimit untouched - Pentester accounts (ids 42-48) deleted in prod DB
25 lines
807 B
JavaScript
25 lines
807 B
JavaScript
import { withPayload } from '@payloadcms/next/withPayload'
|
|
|
|
/** @type {import('next').NextConfig} */
|
|
const nextConfig = {
|
|
output: 'standalone',
|
|
poweredByHeader: false,
|
|
async headers() {
|
|
return [{
|
|
source: '/:path*',
|
|
headers: [
|
|
{ key: 'X-Frame-Options', value: 'DENY' },
|
|
{ key: 'X-Content-Type-Options', value: 'nosniff' },
|
|
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
|
|
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
|
|
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains' },
|
|
],
|
|
}]
|
|
},
|
|
eslint: { ignoreDuringBuilds: true },
|
|
typescript: { ignoreBuildErrors: false },
|
|
experimental: {},
|
|
}
|
|
|
|
export default withPayload(nextConfig)
|