Hardening Next.js: Security Headers, CSP & Input Hygiene

Minimum Headers

• Strict-Transport-Security with long max-age and preload.
• X-Content-Type-Options: nosniff, Permissions-Policy, COOP/COEP.
• CSP with nonces: script-src 'self' 'nonce-...'.

Input Hygiene

Validate at the boundary, sanitize outputs, and log anomalies with request IDs and user context.

Operational Guardrails

Automate SAST/DAST in CI, keep SBOMs, and fail builds on criticals.