[rfc] layers: custom CSP merger

[dargmuesli]

Hey, I'm thinking about CSP and Nuxt layers... I suppose that currently in nuxt-security the headers of different layers would be merged using the standard defu strategy (as with all Nuxt config).

I'm thinking about ways to widen the possibilities there. Imagine one layer defining 'none' and the next layer defining a value. That would require 'none' to be removed. Then another layer might come which wishes to override the previously set value back to 'none'. I think that's currently not possible, but would be cool if it was! A custom merger would surely be needed.

But before I hop into custom code I hereby want to make those thoughts transparent as there might be other good ideas about that too! What comes to your mind?

[dargmuesli]

I think in the end the most plausible solution is to let each layer define a function which receives the result of all earlier layers as input parameter and freely do any changes to that. I think of something like nuxt-i18n's i18n.config.ts (nuxt-modules/i18n#1948).
Putting constraints on that with static object syntax will in any case be limiting.

[Baroshem]

No worries! Take your time and let me know if there is anything I can help with :)

[dargmuesli]

I now think there is no need for a custom CSP merger because a Nuxt layer can use a(n inline) module to make changes to the security configuration like to remove the default 'none' on object-src:

export default defineNuxtConfig(
  {
    extends: 'some-layer-adding-nuxt-security',
    modules: [
      (_options, nuxt) => {
        const nuxtConfigSecurity = nuxt.options.security
        if (
          typeof nuxtConfigSecurity.headers !== 'boolean' &&
          nuxtConfigSecurity.headers.contentSecurityPolicy &&
          typeof nuxtConfigSecurity.headers.contentSecurityPolicy !==
            'boolean' &&
          typeof nuxtConfigSecurity.headers.contentSecurityPolicy !==
            'string' &&
          nuxtConfigSecurity.headers.contentSecurityPolicy['object-src']
        ) {
          nuxtConfigSecurity.headers.contentSecurityPolicy['object-src'] =
            nuxtConfigSecurity.headers.contentSecurityPolicy[
              'object-src'
            ].filter((x) => x !== "'none'")
        }
        console.log(nuxt.options.security)
      },
    ],
  }
)

That's for the v1 rc. A little bit verbose due to the type checks. Let's see how types end up being defined for the v1 release.

[Baroshem]

I see. It makes complete sense.

To not let this info disappear, maybe we could add it to the new documenation somewhere? Maybe in the configuration section below the configuration options?

[dargmuesli]

Here you go: #226 🚀

[Baroshem]

My Man! Great work, I will review it in the next few hours :)