dansmaculotte/nuxt-security

Module for Nuxt.js to configure security headers and more

nuxt-security's Issues

Deprecated, why?

I saw the deprecation mark, but didn't find a reason for it. Could you explain? npm support cannot be contacted that easily.
I cannot find a similar package as https://www.npmjs.com/package/nuxt-security is for Nuxt 3 only as it seems.

Will this work on Nuxt 3?

If not could we mark this as the Nuxt 2 module? There is another module for Nuxt 3.
Just making sure. Thanks.

https://www.npmjs.com/package/nuxt-security

Workbox constantly blocked

I started using PWA Workbox on my Nuxt project but I cannot get rid of the Content Security Policy for https://cdn.jsdelivr.net/npm/[email protected]/workbox/workbox-sw.js

It is correctly set in the scriptSrc like this: 'cdn.jsdelivr.net' but it seems to ignore it.

Am I missing something with this? Thanks

-

Feature Policy to Permission Policy

Hi, I just saw that the Feature Policy is now renamed to Permission Policy. When will this reflect in nuxt-security ? because in the configuration, it is still using the feature-policy and prompting a warning in the console. "error with feature-policy header unrecognized feature 'notifications'". Thank you

Add cache-control header

Thanks for this module! Its helped a lot.

Do you have any plans to add the cache-control header?

The module still runs when dev is set to false.

I set the nuxt.config.js file with the following settings:

modules: [
    '@nuxtjs/axios',
    '@nuxtjs/pwa',
    [
      '@dansmaculotte/nuxt-security',
      {
        dev: false,
        csp: {
          directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'"],
            connectSrc: ["'self'"],
            imgSrc: ["'self'"],
            styleSrc: ["'self'"]
          },
          loose: false,
          reportOnly: false,
          setAllHeaders: false,
          disableAndroid: false,
          browserSniff: true
        },
      }
    ]
  ],

The CSP headers still load when I use the npm run dev command.

YouTube embed

How to make YouTube embed work with this module?