Security Hardening
Next.js security hardening, OWASP compliance, and production security checklist
Metadata
- Name: security-hardening
- Version: 1.0.0
- Author: webrenew
- Tags: nextjs, security, owasp, csp, authentication, authorization, xss, csrf, headers
When to Use
This skill should be used when:
- Hardening a Next.js application for production deployment
- Configuring security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy)
- Implementing authentication and authorization (Auth.js, middleware, RBAC)
- Securing API routes and Server Actions (input validation, rate limiting, CORS)
- Preventing data exposure from Server Components to Client Components
- Setting up dependency security scanning (npm audit, Snyk, Dependabot)
- Reviewing OWASP Top 10 vulnerabilities specific to Next.js
- Configuring Vercel-specific security (Firewall, WAF, deployment protection)
Summary
Comprehensive Next.js security hardening guide covering security headers and CSP with nonces, authentication patterns with Auth.js v5, authorization via Data Access Layer and middleware, Server Action security (CSRF, validation, rate limiting), API route protection, input validation with Zod, XSS and SQL injection prevention, environment variable management, data exposure prevention (server-only, taint API, DTOs), cookie security, middleware-based rate limiting and bot detection, secure error handling, dependency auditing, Vercel security features, OWASP Top 10 mapped to Next.js, and pre-deployment security checklists.
1---2name: security-hardening3description: Find and fix common security gaps in Next.js apps. Use this skill for security headers, authentication, authorization, Server Actions, API routes, validation, rate limits, dependency checks, and OWASP reviews.4---56# Security Hardening78> Next.js security hardening, OWASP compliance, and production security checklist910## Metadata1112- **Name**: security-hardening13- **Version**: 1.0.014- **Author**: webrenew15- **Tags**: nextjs, security, owasp, csp, authentication, authorization, xss, csrf, headers1617## When to Use1819This skill should be used when:20- Hardening a Next.js application for production deployment21- Configuring security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy)22- Implementing authentication and authorization (Auth.js, middleware, RBAC)23- Securing API routes and Server Actions (input validation, rate limiting, CORS)24- Preventing data exposure from Server Components to Client Components25- Setting up dependency security scanning (npm audit, Snyk, Dependabot)26- Reviewing OWASP Top 10 vulnerabilities specific to Next.js27- Configuring Vercel-specific security (Firewall, WAF, deployment protection)2829## Summary3031Comprehensive Next.js security hardening guide covering security headers and CSP with nonces, authentication patterns with Auth.js v5, authorization via Data Access Layer and middleware, Server Action security (CSRF, validation, rate limiting), API route protection, input validation with Zod, XSS and SQL injection prevention, environment variable management, data exposure prevention (server-only, taint API, DTOs), cookie security, middleware-based rate limiting and bot detection, secure error handling, dependency auditing, Vercel security features, OWASP Top 10 mapped to Next.js, and pre-deployment security checklists.
webrenew