Next.js security critical
Security Headers & Environment Variables
HTTP security headers (CSP, HSTS, X-Frame-Options), environment variable safety, CORS configuration, and authentication patterns for Next.js 15.
- Difficulty
- intermediate
- Read time
- 1 min read
- Version
- v1.0.0
- Confidence
- established
- Last updated
Quick Reference
Set security headers in next.config.js or middleware. Use CSP to prevent XSS. HSTS forces HTTPS. Never expose secrets without NEXT_PUBLIC_ prefix (and don't use that for secrets). Use 'server-only' package for server code. Validate Origin in Server Actions. Check authentication in every Server Action.
Use When
- Configuring HTTP security headers
- Managing environment variables
- Setting up CORS
- Implementing authentication checks
Skip When
- Development-only configurations
- Using external security proxy (Cloudflare, etc.)
Security Headers & Environment Variables
HTTP security headers (CSP, HSTS, X-Frame-Options), environment variable safety, CORS configuration, and authentication patterns for Next.js 15.