next-server-with-csp.js

const express = require("express");
const next = require("next");
const compression = require("compression");
const helmet = require("helmet");
const morgan = require("morgan");
const { logger } = require('./logger');

async function startSever() {
  const dev = process.env.NODE_ENV === 'development';
  const app = next({ dev });
  const handle = app.getRequestHandler();
  const port = process.env.PORT || 4000;

  try {
    await app.prepare();
    const server = express();

    server.use(express.json());
    server.use(express.urlencoded({ extended: true }));
    server.use(compression());
    server.use(helmet({
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'self'", "'unsafe-eval'", 'wss://*.firebaseio.com', "https://*.googleapis.com", 'https://apis.google.com'],
          styleSrc: ["'self'", "'unsafe-inline'", 'https:'],
          fontSrc: ["'self'", 'https:', 'data:'],
          imgSrc: ["'self'", 'https:', 'data:'],
          scriptSrc: ["'self'", 'https://*.firebaseio.com', 'https://apis.google.com', "'unsafe-inline'", "'unsafe-eval'"],
          frameSrc: ["'self'", 'https://*.firebaseio.com','https://*.firebaseapp.com'],
        }
      }
    }));
    server.use(morgan('short', { stream: logger.stream }));

    server.all("*", (req, res) => {
      return handle(req, res);
    });

    server.listen(port, (err) => {
      if (err) throw err;
      logger.info({ port }, 'Hello! starting server');
    });
  } catch (reason) {
    console.error(reason.stack);
    process.exit(1);
  }
}

startSever();