fix(security): static assets not rendering

Author: waleedlatif1

sim/next.config.ts

@@ -1,23 +1,13 @@
 import type { NextConfig } from 'next'
 
-// Check if we're building for standalone distribution
-const isStandaloneBuild = process.env.USE_LOCAL_STORAGE === 'true'
-
 const nextConfig: NextConfig = {
   devIndicators: false,
-  experimental: {
-    sri: {
-      algorithm: 'sha256'
-    }
-  },
   images: {
     domains: [
       'avatars.githubusercontent.com',
       'oaidalleapiprodscus.blob.core.windows.net',
       'api.stability.ai',
-    ],
-    // Enable static image optimization for standalone export
-    unoptimized: isStandaloneBuild,
+    ]
   },
   // Always use 'standalone' output to support API routes
   output: 'standalone',
@@ -34,13 +24,10 @@ const nextConfig: NextConfig = {
     return config
   },
   // Only include headers when not building for standalone export
-  ...(isStandaloneBuild
-    ? {}
-    : {
-        async headers() {
-          return [
-            {
-              // API routes CORS headers - keep no-cache for dynamic API endpoints
+  async headers() {
+    return [
+      {
+              // API routes CORS headers
               source: '/api/:path*',
               headers: [
                 { key: 'Access-Control-Allow-Credentials', value: 'true' },
@@ -57,110 +44,6 @@ const nextConfig: NextConfig = {
                   value:
                     'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version',
                 },
-                {
-                  key: 'Cache-Control',
-                  value: 'no-store, no-cache, must-revalidate, proxy-revalidate',
-                },
-                {
-                  key: 'Pragma',
-                  value: 'no-cache',
-                },
-                {
-                  key: 'Expires',
-                  value: '0',
-                },
-                {
-                  key: 'Surrogate-Control',
-                  value: 'no-store',
-                },
-              ],
-            },
-            {
-              // Static assets - long caching for better performance
-              // This targets common static file extensions
-              source: '/:path*.(js|css|svg|png|jpg|jpeg|gif|webp|avif|ico|woff|woff2|ttf|eot)',
-              headers: [
-                {
-                  key: 'Cache-Control',
-                  value: 'public, max-age=31536000, immutable',
-                },
-                {
-                  key: 'Vary',
-                  value: 'User-Agent',
-                },
-              ],
-            },
-            {
-              // HTML/dynamic content - use validation caching instead of no-cache
-              source: '/:path*',
-              has: [
-                {
-                  type: 'header',
-                  key: 'Accept',
-                  value: '(.*text/html.*)',
-                },
-              ],
-              headers: [
-                {
-                  key: 'X-Content-Type-Options',
-                  value: 'nosniff',
-                },
-                {
-                  key: 'X-Frame-Options',
-                  value: 'SAMEORIGIN',
-                },
-                {
-                  key: 'Content-Security-Policy',
-                  value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'",
-                },
-                {
-                  key: 'Cache-Control',
-                  value: 'public, max-age=0, must-revalidate',
-                },
-                {
-                  key: 'Vary',
-                  value: 'User-Agent',
-                },
-              ],
-            },
-            {
-              // Apply security headers to all routes
-              source: '/:path*',
-              headers: [
-                {
-                  key: 'X-Content-Type-Options',
-                  value: 'nosniff',
-                },
-                {
-                  key: 'X-Frame-Options',
-                  value: 'SAMEORIGIN',
-                },
-                {
-                  key: 'Content-Security-Policy',
-                  value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'",
-                },
-              ],
-            },
-            {
-              // Dynamic routes containing user data - strict no caching
-              source: '/w/:path*',
-              headers: [
-                {
-                  key: 'Cache-Control',
-                  value: 'private, no-store, no-cache, must-revalidate, proxy-revalidate',
-                },
-                {
-                  key: 'Pragma',
-                  value: 'no-cache',
-                },
-                {
-                  key: 'Expires',
-                  value: '0',
-                },
-                {
-                  key: 'Surrogate-Control',
-                  value: 'no-store',
-                },
               ],
             },
             {
@@ -187,9 +70,26 @@ const nextConfig: NextConfig = {
                 },
               ],
             },
+            // Apply security headers to all routes
+            {
+              source: '/:path*',
+              headers: [
+                {
+                 key: 'X-Content-Type-Options',
+                 value: 'nosniff',
+               },
+               {
+                 key: 'X-Frame-Options',
+                 value: 'SAMEORIGIN',
+               },
+               {
+                 key: 'Content-Security-Policy',
+                 value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; object-src 'none'",
+               },
+             ],
+           },
           ]
-        },
-      }),
+  },
 }
 
-export default nextConfig
+export default nextConfig