Description
The Next.js app currently ships without a Content Security Policy or other hardening headers, making it vulnerable to XSS, clickjacking, and MIME-sniffing attacks. All security-relevant HTTP headers should be configured in one place and enforced for every response, including API routes and RSC payloads.
Technical Context
Headers configured in next.config.js under the headers() async function, supplemented by a middleware file at src/middleware.ts for dynamic CSP nonce injection. Headers to add: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy. The CSP script-src directive must accommodate Next.js inline scripts via a per-request nonce passed through src/lib/csp.ts.
Acceptance Criteria
Description
The Next.js app currently ships without a Content Security Policy or other hardening headers, making it vulnerable to XSS, clickjacking, and MIME-sniffing attacks. All security-relevant HTTP headers should be configured in one place and enforced for every response, including API routes and RSC payloads.
Technical Context
Headers configured in
next.config.jsunder theheaders()async function, supplemented by a middleware file atsrc/middleware.tsfor dynamic CSP nonce injection. Headers to add:Content-Security-Policy,Strict-Transport-Security,X-Frame-Options: DENY,X-Content-Type-Options: nosniff,Referrer-Policy: strict-origin-when-cross-origin,Permissions-Policy. The CSPscript-srcdirective must accommodate Next.js inline scripts via a per-request nonce passed throughsrc/lib/csp.ts.Acceptance Criteria
curl -Iagainst any app route shows all six headers present with correct values<script>tag via the middlewareX-Frame-Options: DENYprevents the app from being embedded in an iframe on a third-party originsecurityheaders.comscan returns an A grade