feat: increased security

next.config.mjs

@@ -1,6 +1,19 @@
 import createNextIntlPlugin from "next-intl/plugin";
  
-const nextConfig = {};
+const nextConfig = {
+  headers: async () => [{
+    source: "/(.*)",
+    headers: [
+      { key: "X-Frame-Options", value: "DENY" },
+      { key: "X-Content-Type-Options", value: "nosniff" },
+      { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+      { key: "X-XSS-Protection", value: "1; mode=block" },
+      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
+      { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
+      { key: "Content-Security-Policy", value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'" },
+    ],
+  }],
+};
  
 const withNextIntl = createNextIntlPlugin();
 export default withNextIntl(nextConfig);