Next.js Security

Priority: P0 (CRITICAL)

Structure

app/
├── lib/
│   └── validation.ts   # Shared Zod schemas
└── middleware.ts       # Auth & Headers

Implementation Guidelines

• Next.js Middleware: Use

  middleware.ts

  for edge-side authentication, role-based access control (RBAC), and enforcing Security Headers (e.g.,

  Content-Security-Policy (CSP)

  ,

  X-XSS-Protection

  ).
• Server Actions: Always sanitize all inputs from

  FormData

  or JSON using Zod. Perform authentication checks (

  await auth()

  ) inside every action to verify the caller.
• Data Tainting: Use the

  experimental_taint

  API (

  taintObjectReference

  ) to ensure sensitive server objects (e.g., User with

  passwordHash

  ) never leak into a Client Component.
• Route Handlers (

  route.ts

  ): Implement rate limiting to prevent brute-force or DoS attacks. Verify Origin/Referer headers to mitigate CSRF (Cross-Site Request Forgery).
• Auth Tokens: strictly use

  HttpOnly

  ,

  Secure

  cookies with

  SameSite: 'Lax'

  for session management. Never store tokens in

  localStorage

  .
• Logic Isolation: use the

  server-only

  package to prevent backend-specific logic from being included in the client bundle.
• Component Purity: Escape all user-provided content rendered in components. Never use

  dangerouslySetInnerHTML

  without a sanitizer like

  DOMPurify

  .

Anti-Patterns

• No leaking DB fields to client: Use DTOs; never pass raw model objects.
• No

  process.env

  in client bundles: Mark as

  NEXT_PUBLIC_

  only if safe to expose.
• No unvalidated Server Action inputs: Always validate with Zod schema.
• No auth checks in shared Layouts: Auth in layouts is insecure; use Middleware.

References

• Secure App Router Patterns