From 4c763ecbf2eb62907a142daf78d4359272a0d1bc Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Wed, 11 Jun 2025 06:23:08 +0100
Subject: [PATCH] fix: remove nuxt-security plugins in production

---
 modules/security.ts      | 23 +++++++++++++++++++++++
 server/api/logger.get.ts |  7 +++++++
 test/unit/bundle.spec.ts |  6 ++----
 3 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 modules/security.ts
 create mode 100644 server/api/logger.get.ts

diff --git a/modules/security.ts b/modules/security.ts
new file mode 100644
index 00000000..dd7785c3
--- /dev/null
+++ b/modules/security.ts
@@ -0,0 +1,23 @@
+import { defineNuxtModule, useNuxt } from 'nuxt/kit'
+
+export default defineNuxtModule({
+  meta: {
+    name: 'nuxt-security-prerender',
+  },
+  setup () {
+    const nuxt = useNuxt()
+    nuxt.hook('nitro:init', nitro => {
+      const nuxtSecurityPlugins = new Set<string>()
+      // remove nuxt-security's plugins from deployed server but keep them when prerendering
+      nitro.options.plugins = nitro.options.plugins.filter(plugin => {
+        if (plugin.includes('node_modules/nuxt-security/')) {
+          nuxtSecurityPlugins.add(plugin)
+          return false
+        }
+        return true
+      })
+      // remove nuxt-security middleware from deployed server
+      nitro.options.handlers = nitro.options.handlers.filter(handler => !handler.handler.includes('node_modules/nuxt-security/'))
+    })
+  },
+})
diff --git a/server/api/logger.get.ts b/server/api/logger.get.ts
new file mode 100644
index 00000000..78045203
--- /dev/null
+++ b/server/api/logger.get.ts
@@ -0,0 +1,7 @@
+export default defineEventHandler(async event => {
+  // try to work around missing env variables on cloudflare workers
+  console.log('runtime config 1', useRuntimeConfig(event))
+  console.log('runtime config 2', useRuntimeConfig())
+  console.log('runtime config 3', useRuntimeConfig(event))
+  console.log('env', event.context)
+})
diff --git a/test/unit/bundle.spec.ts b/test/unit/bundle.spec.ts
index 727062fa..0ede3a04 100644
--- a/test/unit/bundle.spec.ts
+++ b/test/unit/bundle.spec.ts
@@ -79,12 +79,12 @@ describe('project sizes', () => {
     stats.server = await analyzeSizes(['**/*.mjs', '!node_modules'], serverDir)
     expect
       .soft(roundToKilobytes(stats.server.totalBytes))
-      .toMatchInlineSnapshot(`"869k"`)
+      .toMatchInlineSnapshot(`"832k"`)
 
     const modules = await analyzeSizes('node_modules/**/*', serverDir)
     expect
       .soft(roundToKilobytes(modules.totalBytes))
-      .toMatchInlineSnapshot(`"11590k"`)
+      .toMatchInlineSnapshot(`"11354k"`)
 
     const packages = modules.files
       .filter(m => m.endsWith('package.json'))
@@ -138,7 +138,6 @@ describe('project sizes', () => {
         "character-reference-invalid",
         "comma-separated-tokens",
         "consola",
-        "cssfilter",
         "debug",
         "decode-named-character-reference",
         "decompress-response",
@@ -308,7 +307,6 @@ describe('project sizes', () => {
         "vue-bundle-renderer",
         "web-namespaces",
         "xml-js",
-        "xss",
         "yaml",
         "zod",
         "zod/dist/cjs",
-- 
2.51.2