CSP for Next.js
Next.js can be static, server-rendered, streamed, or edge-rendered, so the safest rollout is to start with a minimal policy, observe real requests, and then tighten by deployment mode.
What usually matters most
script-srcfor/_nextassets and third-party scripts.style-srcfor CSS-in-JS or framework-generated style tags.img-srcfor remote images and previews.connect-srcfor APIs, analytics, and streaming.
Common pattern
Use nonce-based CSP when rendering dynamically through middleware or edge logic. Use hash-based exceptions only for fixed inline snippets.