Revert "fix(frontend): CSP nonce for JSON-LD structured-data script on profile pages"

frontend/src/app/profile/[username]/page.tsx

@@ -1,5 +1,4 @@
 import { notFound } from "next/navigation";
-import { headers } from "next/headers";
 import type { Metadata } from "next";
 import { AppShell } from "@/components/app-shell";
 import { ProfileCard } from "@/components/profile-card";
@@ -251,13 +250,10 @@ export default async function ProfilePage({ params }: PageProps) {
     },
   };
 
-  const nonce = headers().get("x-csp-nonce") ?? undefined;
-
   return (
     <AppShell>
       <script
         type="application/ld+json"
-        nonce={nonce}
         dangerouslySetInnerHTML={{ __html: JSON.stringify(jsonLd) }}
       />
       <div className="grid grid-cols-1 lg:grid-cols-[1fr_380px] gap-8 items-start animate-fade-in">

frontend/src/middleware.ts

@@ -5,27 +5,17 @@ import type { NextRequest } from "next/server";
 // since process.env there is only resolved at build time and would bake in
 // an empty connect-src on hosts where these vars are injected at runtime.
 export function middleware(request: NextRequest) {
-  // Per-request nonce so server-rendered inline scripts (e.g. the JSON-LD
-  // structured-data block on profile pages) can be allow-listed individually
-  // under the strict `script-src 'self'` policy below.
-  const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+  const response = NextResponse.next();
 
   const csp = [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}'`,
+    "script-src 'self'",
     "style-src 'self' 'unsafe-inline'",
     `connect-src 'self' ${process.env.NEXT_PUBLIC_API_BASE_URL ?? ""} ${process.env.NEXT_PUBLIC_HORIZON_URL ?? ""} ${process.env.NEXT_PUBLIC_SOROBAN_RPC_URL ?? ""}`,
     "img-src 'self' data: blob: https:",
     "frame-ancestors 'none'",
   ].join("; ");
 
-  const requestHeaders = new Headers(request.headers);
-  requestHeaders.set("x-csp-nonce", nonce);
-
-  const response = NextResponse.next({
-    request: { headers: requestHeaders },
-  });
-
   response.headers.set("Content-Security-Policy", csp);
 
   return response;