Nils-Johan Gynther
46 lines
1.3 KiB
TypeScript
46 lines
1.3 KiB
TypeScript
import { ValidationPipe } from '@nestjs/common';
|
|
import { NestFactory } from '@nestjs/core';
|
|
import { AppModule } from './app.module';
|
|
import { GlobalExceptionFilter } from './common/filters/global-exception.filter';
|
|
import helmet from 'helmet';
|
|
|
|
async function bootstrap() {
|
|
const app = await NestFactory.create(AppModule);
|
|
|
|
// Helmet som säkerhetsbackup (CSP hanteras av Next.js/Caddy)
|
|
app.use(
|
|
helmet({
|
|
contentSecurityPolicy: false,
|
|
crossOriginEmbedderPolicy: true,
|
|
crossOriginOpenerPolicy: { policy: 'same-origin' },
|
|
crossOriginResourcePolicy: { policy: 'same-origin' },
|
|
originAgentCluster: true,
|
|
referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
|
|
strictTransportSecurity: {
|
|
maxAge: 31536000,
|
|
includeSubDomains: true,
|
|
preload: true,
|
|
},
|
|
xContentTypeOptions: true,
|
|
xFrameOptions: { action: 'deny' },
|
|
xXssProtection: false, // Deprecated, hanteras av Caddy
|
|
}),
|
|
);
|
|
|
|
app.setGlobalPrefix('api');
|
|
|
|
// Registrera global exception filter
|
|
app.useGlobalFilters(new GlobalExceptionFilter());
|
|
|
|
app.useGlobalPipes(
|
|
new ValidationPipe({
|
|
whitelist: true,
|
|
forbidNonWhitelisted: true,
|
|
transform: true,
|
|
}),
|
|
);
|
|
|
|
await app.listen(8080, '0.0.0.0');
|
|
}
|
|
bootstrap();
|