fix: resolve dev server static asset warnings and 404 errors

- Remove unnecessary nonce warnings for static assets
- Update middleware to properly skip static file processing
- Fix unused variable error in catch block
- Eliminate console spam during development

lib/nonce-utils.ts

@@ -8,19 +8,12 @@ export async function getNonce(): Promise<string | undefined> {
     const headersList = await headers();
     const nonce = headersList.get("X-Nonce");
 
-    // Log for debugging hydration issues
-    if (!nonce && process.env.NODE_ENV === "development") {
-      console.warn(
-        "No nonce found in headers - this may cause hydration mismatches"
-      );
-    }
-
+    // Don't warn about missing nonce as it's expected for static assets
+    // The middleware only adds nonce for non-static routes
     return nonce || undefined;
-  } catch (error) {
+  } catch {
     // Headers not available (e.g., in client-side code)
-    if (process.env.NODE_ENV === "development") {
-      console.warn("Failed to get headers for nonce:", error);
-    }
+    // This is expected and not an error
     return undefined;
   }
 }

middleware.ts

@@ -2,21 +2,21 @@ import { type NextRequest, NextResponse } from "next/server";
 import { buildCSP, generateNonce } from "@/lib/csp-server";
 
 export function middleware(request: NextRequest) {
-  // Skip CSP for API routes (except CSP report endpoint)
+  const pathname = request.nextUrl.pathname;
+
+  // Skip middleware entirely for static assets and Next.js internals
   if (
-    request.nextUrl.pathname.startsWith("/api") &&
-    !request.nextUrl.pathname.startsWith("/api/csp-report")
+    pathname.startsWith("/_next/") ||
+    pathname.startsWith("/api/") ||
+    pathname.includes(".") ||
+    pathname.startsWith("/favicon")
   ) {
+    // Skip CSP for API routes except CSP report endpoint
+    if (pathname === "/api/csp-report") {
+      // Allow CSP report endpoint to proceed with CSP headers
+    } else {
       return NextResponse.next();
     }
-
-  // Skip CSP for static assets
-  if (
-    request.nextUrl.pathname.startsWith("/_next") ||
-    request.nextUrl.pathname.startsWith("/favicon") ||
-    request.nextUrl.pathname.includes(".")
-  ) {
-    return NextResponse.next();
   }
 
   const response = NextResponse.next();
@@ -104,13 +104,18 @@ export function middleware(request: NextRequest) {
 export const config = {
   matcher: [
     /*
-     * Match all request paths except for the ones starting with:
-     * - api (API routes, handled separately)
-     * - _next/static (static files)
-     * - _next/image (image optimization files)
-     * - favicon.ico (favicon file)
-     * - public folder files
+     * Match all request paths except:
+     * - API routes (except /api/csp-report)
+     * - Next.js internals (_next)
+     * - Static files (anything with a file extension)
+     * - Favicon
      */
-    "/((?!api|_next/static|_next/image|favicon.ico|.*\\..*|public).*)",
+    {
+      source: "/((?!_next|favicon.ico).*)",
+      missing: [
+        { type: "header", key: "next-router-prefetch" },
+        { type: "header", key: "purpose", value: "prefetch" },
+      ],
+    },
   ],
 };