You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I had the same issue.
When i18n is enabled, the path for the homepage is "/en", but the language prefix is stripped before matching the path but doesn't contain a trailing slash anymore. Hence an empty string is matched against /(.*).
The solution is to add locale: false to prevent NextJS from stripping the language prefix. I would suggest adding this to the code in the readme. Setting this option has no effect when i18n is not in use.
It would be good if this could be reviewed and updated in the readme soon. When enabling i18n later on, the security headers' absence may go unnoticed, hence putting the site at risk.
💩 Bug Report
A summary of the bug
Using i18n internationalization will cause secure headers to disappear
Current behavior
If you have this in your next.config.js:
Your headers will not be used.
To Reproduce
Steps to reproduce the behavior, please provide code snippets or a repository.
i18n: { defaultLocale: "de", locales: ["de"] },
Expected behavior
CSP Headers to work when i18n locales are set.
Environment
v2.2.0
v14.15.4
Windows 10
Additional context
The headers config i used:
The text was updated successfully, but these errors were encountered: