Skip to content

Commit a81ccf2

Browse files
committed
fix: complete CSP configuration for Firebase Auth + add debug endpoint
- Add Firebase app domains to frame-src for auth popups - Add Vercel live feedback script to script-src - Create auth status debug endpoint for troubleshooting - Should resolve remaining Firebase Auth CSP blocking issues
1 parent b0df65e commit a81ccf2

File tree

2 files changed

+109
-2
lines changed

2 files changed

+109
-2
lines changed

app/api/debug/auth-status/route.ts

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
import { NextRequest, NextResponse } from 'next/server';
2+
import { cookies } from 'next/headers';
3+
import { getFirebaseAdmin } from '../../../firebase/firebaseAdmin';
4+
5+
/**
6+
* Debug Auth Status API Endpoint
7+
*
8+
* Returns detailed authentication status information
9+
* to help debug authentication issues.
10+
*/
11+
export async function GET(request: NextRequest) {
12+
try {
13+
const cookieStore = await cookies();
14+
const allCookies = cookieStore.getAll();
15+
16+
// Get session cookie
17+
const sessionCookie = cookieStore.get('simpleUserSession');
18+
19+
// Environment info
20+
const envInfo = {
21+
nodeEnv: process.env.NODE_ENV,
22+
vercelEnv: process.env.VERCEL_ENV,
23+
useDevAuth: process.env.NODE_ENV === 'development' && process.env.NEXT_PUBLIC_USE_DEV_AUTH === 'true'
24+
};
25+
26+
// Cookie info
27+
const cookieInfo = {
28+
totalCookies: allCookies.length,
29+
cookieNames: allCookies.map(c => c.name),
30+
hasSimpleUserSession: !!sessionCookie,
31+
sessionCookieValue: sessionCookie ? 'present' : 'missing'
32+
};
33+
34+
// Session data
35+
let sessionData = null;
36+
let sessionError = null;
37+
38+
if (sessionCookie) {
39+
try {
40+
sessionData = JSON.parse(sessionCookie.value);
41+
} catch (error) {
42+
sessionError = 'Failed to parse session cookie';
43+
}
44+
}
45+
46+
// Firebase Admin status
47+
let firebaseAdminStatus = 'unknown';
48+
try {
49+
const admin = getFirebaseAdmin();
50+
firebaseAdminStatus = admin ? 'initialized' : 'not initialized';
51+
} catch (error) {
52+
firebaseAdminStatus = `error: ${error.message}`;
53+
}
54+
55+
const debugInfo = {
56+
timestamp: new Date().toISOString(),
57+
environment: envInfo,
58+
cookies: cookieInfo,
59+
session: {
60+
hasSessionData: !!sessionData,
61+
sessionError,
62+
userData: sessionData ? {
63+
uid: sessionData.uid,
64+
email: sessionData.email,
65+
username: sessionData.username,
66+
emailVerified: sessionData.emailVerified
67+
} : null
68+
},
69+
firebase: {
70+
adminStatus: firebaseAdminStatus
71+
},
72+
request: {
73+
url: request.url,
74+
method: request.method,
75+
userAgent: request.headers.get('user-agent'),
76+
origin: request.headers.get('origin'),
77+
referer: request.headers.get('referer')
78+
}
79+
};
80+
81+
return NextResponse.json(debugInfo, {
82+
headers: {
83+
'Cache-Control': 'no-cache, no-store, must-revalidate',
84+
'Pragma': 'no-cache',
85+
'Expires': '0'
86+
}
87+
});
88+
} catch (error) {
89+
console.error('Error in auth status debug API:', error);
90+
91+
return NextResponse.json(
92+
{
93+
error: 'Failed to get auth status',
94+
message: error instanceof Error ? error.message : 'Unknown error',
95+
timestamp: new Date().toISOString()
96+
},
97+
{
98+
status: 500,
99+
headers: {
100+
'Cache-Control': 'no-cache, no-store, must-revalidate',
101+
'Pragma': 'no-cache',
102+
'Expires': '0'
103+
}
104+
}
105+
);
106+
}
107+
}

next.config.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,12 +142,12 @@ const nextConfig = {
142142
key: 'Content-Security-Policy',
143143
value: [
144144
"default-src 'self'",
145-
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://connect-js.stripe.com https://*.stripe.com https://cdn.logrocket.io https://cdn.lr-ingest.io https://cdn.lr-in.com https://cdn.lr-in-prod.com https://cdn.lr-ingest.com https://cdn.ingest-lr.com https://cdn.lgrckt-in.com https://www.googletagmanager.com https://*.googleapis.com https://apis.google.com https://va.vercel-scripts.com",
145+
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://connect-js.stripe.com https://*.stripe.com https://cdn.logrocket.io https://cdn.lr-ingest.io https://cdn.lr-in.com https://cdn.lr-in-prod.com https://cdn.lr-ingest.com https://cdn.ingest-lr.com https://cdn.lgrckt-in.com https://www.googletagmanager.com https://*.googleapis.com https://apis.google.com https://va.vercel-scripts.com https://vercel.live",
146146
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://connect-js.stripe.com https://*.stripe.com",
147147
"font-src 'self' https://fonts.gstatic.com",
148148
"img-src 'self' data: https: https://*.stripe.com https://*.tile.openstreetmap.org https://*.basemaps.cartocdn.com https://cdnjs.cloudflare.com",
149149
"connect-src 'self' https://api.stripe.com https://connect-js.stripe.com https://*.stripe.com wss://*.stripe.com https://*.googleapis.com https://apis.google.com https://firebase.googleapis.com https://firebaseinstallations.googleapis.com wss://*.firebaseio.com https://*.firebaseio.com https://www.googletagmanager.com https://www.google-analytics.com https://analytics.google.com https://*.logrocket.io https://*.lr-ingest.io https://*.logrocket.com https://*.lr-in.com https://*.lr-in-prod.com https://*.lr-ingest.com https://*.ingest-lr.com https://cdn.lgrckt-in.com https://*.lgrckt-in.com https://va.vercel-scripts.com https://*.vercel-scripts.com",
150-
"frame-src 'self' https://js.stripe.com https://connect-js.stripe.com https://*.stripe.com",
150+
"frame-src 'self' https://js.stripe.com https://connect-js.stripe.com https://*.stripe.com https://*.firebaseapp.com https://wewrite-ccd82.firebaseapp.com",
151151
"worker-src 'self' blob:",
152152
"child-src 'self' blob:",
153153
"object-src 'none'",

0 commit comments

Comments
 (0)