# Nextjs Secure Bff

> Use for security-sensitive Next.js backend-for-frontend work involving Route Handlers, Proxy, Server Actions, webhooks, callbacks, data access layers, server-only modules, request validation, rate limits, or public API boundaries. Prefer this skill when a Next.js task exposes HTTP endpoints or moves privileged data across server/client boundaries.

- Skill: `xirothedev/nextjs-secure-bff` (Agent Skill, multi-file: 30 files)
- Install (CLI): `npx skillmds@latest add xirothedev/nextjs-secure-bff`
- Raw SKILL.md: https://api.skillmd.com/api/skills/xirothedev/nextjs-secure-bff/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: xirothedev (https://skillmd.com/u/xirothedev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/xirothedev/nextjs-secure-bff

---


# Next.js Secure BFF

Use this skill when Next.js acts as a public backend boundary, not just a rendering layer. Treat Route Handlers, Proxy, and Server Actions as externally reachable entry points that need normal backend security review.

## When to Apply

Use this skill when:
- Writing or reviewing `app/**/route.ts`, `proxy.ts`, webhook handlers, callback URLs, or BFF proxy endpoints
- Designing Server Actions that mutate data or depend on authenticated users
- Moving database, secrets, or internal API access into a Next.js app
- Auditing whether data passed to Client Components is minimized and safe
- Debugging leaks through headers, serialized action results, logs, or broad DTOs

## Load On Demand

Start with this file. Load detailed files only when the task needs them:

```
references/_sections.md
references/api-route-boundaries.md
references/security-server-action-authz.md
references/security-dal-dto.md
references/security-env-server-only.md
references/api-webhook-validation.md
references/api-proxy-headers.md
dataset/security/server-action-authz/correct.ts
sources/inventory.json
```

Each rule file includes:
- Why the pattern matters
- Incorrect and correct examples
- Dataset path with larger TypeScript/TSX examples
- Official source references

## Rule Categories by Priority

Resolve conflicts by lower priority number first. At the same priority, prefer Security, API, then Operations.

| Priority | Category | Impact | Prefix |
|----------|----------|--------|--------|
| 1 | Security & Authorization | CRITICAL | `security-` |
| 2 | Public API Boundaries | CRITICAL | `api-` |
| 3 | Operations & Runtime Controls | HIGH | `ops-` |

## Source Policy

Prefer official Next.js docs for framework semantics. For auth libraries, follow the library's official adapter docs after this skill establishes the Next.js security boundary. Do not copy community webhook, proxy, or Server Action snippets unless they validate inputs, re-authorize the caller, and filter outputs.