svrjs/svrjs-website
Archived
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: svrjs:f213ba4a6550276c6e782fa056c665e0c2ce3df3
Branches Tags
svrjs:main
...
compare: svrjs:5ea8f523243701ed260b85e35ac9060ce10c3f9e
Branches Tags
svrjs:main

2 commits
f213ba4a65 ... 5ea8f52324

Author SHA1 Message Date
Dorian Niemiec
5ea8f52324 docs: fix invalid JSON on example easywaf-config.json file 2024-09-10 19:38:17 +02:00
Dorian Niemiec
c95cc32122 docs: add a security recommendation to notes for Next.js integration mod 2024-09-10 19:36:05 +02:00
1 changed files with 19 additions and 1 deletions
Show stats Expand all files Collapse all files

20
source/mods.md
View file

@ -67,7 +67,7 @@ If you're using SVR.JS behind a reverse proxy, you need to configure _trustProxy
Example _easywaf-config.json_ file: Example _easywaf-config.json_ file:
```json ```json
{ {
"modules" : { "modules": {
"xss": { "xss": {
"excludePaths": "/^\\/(?:git\\/)?(?:(?!\\.git).)*\\.git\\/|^\\/(?:(?:navbar-)?logo|powered).png$/" "excludePaths": "/^\\/(?:git\\/)?(?:(?!\\.git).)*\\.git\\/|^\\/(?:(?:navbar-)?logo|powered).png$/"
}, },
@ -107,6 +107,24 @@ _View the [change log.](/greenrhombus-changelog)_
The webroot (_wwwroot_ _config.json_ property) serves as a Next.js application directory. It's recommended to set the owner of the Next.js application directory (around with all the files in it) as the user, on which SVR.JS is running (usually "svrjs"). Setting a `NODE_ENV` environment variable to `development` in SVR.JS configuration enables Next.js development server. The webroot (_wwwroot_ _config.json_ property) serves as a Next.js application directory. It's recommended to set the owner of the Next.js application directory (around with all the files in it) as the user, on which SVR.JS is running (usually "svrjs"). Setting a `NODE_ENV` environment variable to `development` in SVR.JS configuration enables Next.js development server.
It's also recommended to forbid the access to ".env" file and ".git" directories, in case Next.js integration mod fails to load. You can set up _nonStandardCodes_ _config.json_ property like this:
```json
{
"nonStandardCodes": [
{
"scode": 403,
"regex": "/^\\/\\.env(?:\\.local)?(?:$|[#?])/"
},
{
"scode": 403,
"regex": "/^\\/\\.git/"
},
...other non-standard codes...
],
...other config.json properties...
}
```
_View the [change log.](/nextjs-integration-changelog)_ _View the [change log.](/nextjs-integration-changelog)_
### OrangeCircle ### OrangeCircle