@@ -8,7 +8,7 @@ import compression from 'compression'
88import express , { type RequestHandler } from 'express'
99import rateLimit from 'express-rate-limit'
1010import getPort , { portNumbers } from 'get-port'
11- // import helmet from 'helmet'
11+ import helmet from 'helmet'
1212import morgan from 'morgan'
1313import { type ServerBuild } from 'react-router'
1414
@@ -95,6 +95,7 @@ export async function createApp(devServer?: any) {
9595 // Everything else (like favicon.ico) is cached for an hour. You may want to be
9696 // more aggressive with this caching.
9797 app . use ( express . static ( 'build/client' , { maxAge : '1h' } ) )
98+ app . use ( '/server' , express . static ( 'build/server' , { maxAge : '1h' } ) )
9899 }
99100
100101 app . get ( [ '/img/*' , '/favicons/*' ] , ( (
@@ -128,38 +129,38 @@ export async function createApp(devServer?: any) {
128129 next ( )
129130 } )
130131
131- // app.use(
132- // helmet({
133- // xPoweredBy: false,
134- // referrerPolicy: { policy: 'same-origin' },
135- // crossOriginEmbedderPolicy: false,
136- // contentSecurityPolicy: {
137- // // NOTE: Remove reportOnly when you're ready to enforce this CSP
138- // reportOnly: true,
139- // directives: {
140- // 'connect-src': [
141- // MODE === 'development' ? 'ws:' : null,
142- // process.env.SENTRY_DSN ? '*.sentry.io' : null,
143- // "'self'",
144- // ].filter(Boolean),
145- // 'font-src': ["'self'"],
146- // 'frame-src': ["'self'"],
147- // 'img-src': ["'self'", 'data:'],
148- // 'script-src': [
149- // "'strict-dynamic'",
150- // "'self'",
151- // // @ts -expect-error
152- // (_, res) => `'nonce-${res.locals.cspNonce}'`,
153- // ],
154- // 'script-src-attr': [
155- // // @ts -expect-error
156- // (_, res) => `'nonce-${res.locals.cspNonce}'`,
157- // ],
158- // 'upgrade-insecure-requests': null,
159- // },
160- // },
161- // }),
162- // )
132+ app . use (
133+ helmet ( {
134+ xPoweredBy : false ,
135+ referrerPolicy : { policy : 'same-origin' } ,
136+ crossOriginEmbedderPolicy : false ,
137+ contentSecurityPolicy : {
138+ // NOTE: Remove reportOnly when you're ready to enforce this CSP
139+ reportOnly : true ,
140+ directives : {
141+ 'connect-src' : [
142+ MODE === 'development' ? 'ws:' : null ,
143+ process . env . SENTRY_DSN ? '*.sentry.io' : null ,
144+ "'self'" ,
145+ ] . filter ( Boolean ) ,
146+ 'font-src' : [ "'self'" ] ,
147+ 'frame-src' : [ "'self'" ] ,
148+ 'img-src' : [ "'self'" , 'data:' ] ,
149+ 'script-src' : [
150+ "'strict-dynamic'" ,
151+ "'self'" ,
152+ // @ts -expect-error
153+ ( _ , res ) => `'nonce-${ res . locals . cspNonce } '` ,
154+ ] ,
155+ 'script-src-attr' : [
156+ // @ts -expect-error
157+ ( _ , res ) => `'nonce-${ res . locals . cspNonce } '` ,
158+ ] ,
159+ 'upgrade-insecure-requests' : null ,
160+ } ,
161+ } ,
162+ } ) ,
163+ )
163164
164165 // When running tests or running in development, we want to effectively disable
165166 // rate limiting because playwright tests are very fast and we don't want to
0 commit comments