Login page only X-FRame-Options header

apps/web/middleware.ts

@@ -1,13 +1,21 @@
 import { collectEvents } from "next-collect/server";
 import { NextMiddleware, NextResponse, userAgent } from "next/server";
 
-import { CONSOLE_URL, WEBAPP_URL, WEBSITE_URL } from "@calcom/lib/constants";
+import { CONSOLE_URL, WEBAPP_URL, WEBSITE_URL, IS_SELF_HOSTED } from "@calcom/lib/constants";
 import { isIpInBanlist } from "@calcom/lib/getIP";
 import { extendEventData, nextCollectBasicSettings } from "@calcom/lib/telemetry";
 
 const middleware: NextMiddleware = async (req) => {
   const url = req.nextUrl;
 
+  //TODO: Might be a good idea to extract out all conditions where IS_SELF_HOSTED is handled in a Cal.config.ts file, so that self hosters can also enable this features just by modifying that config
+  if (url.pathname.startsWith("/auth/login") && !IS_SELF_HOSTED) {
+    console.log("Redirecting to login page");
+    const response = NextResponse.next();
+    response.headers.set("X-Frame-Options", "SAMEORIGIN");
+    return response;
+  }
+
   if (["/api/collect-events", "/api/auth"].some((p) => url.pathname.startsWith(p))) {
     const callbackUrl = url.searchParams.get("callbackUrl");
     const { isBot } = userAgent(req);
@@ -40,7 +48,13 @@ const middleware: NextMiddleware = async (req) => {
 };
 
 export const config = {
-  matcher: ["/api/collect-events/:path*", "/api/auth/:path*", "/apps/routing_forms/:path*", "/:path*/embed"],
+  matcher: [
+    "/api/collect-events/:path*",
+    "/api/auth/:path*",
+    "/apps/routing_forms/:path*",
+    "/:path*/embed",
+    "/auth/login",
+  ],
 };
 
 export default collectEvents({

apps/web/next.config.js

@@ -262,6 +262,29 @@ const nextConfig = {
 
     return redirects;
   },
+  async headers() {
+    const ContentSecurityPolicyForCalHosted = `
+      default-src 'self';
+      script-src 'self';
+      child-src app.cal.com;
+      style-src 'self' app.cal.com;
+      font-src 'self';  
+    `;
+    const redirects = [];
+
+    if (process.env.NEXT_PUBLIC_WEBAPP_URL === "https://app.cal.com") {
+      redirects.push({
+        source: "/:path*",
+        headers: [
+          {
+            key: "Content-Security-Policy",
+            value: ContentSecurityPolicyForCalHosted.replace(/\s{2,}/g, " ").trim(),
+          },
+        ],
+      });
+    }
+    return redirects;
+  },
 };
 
 const sentryWebpackPluginOptions = {