Locking Down MemStack Pro: Adding Security Headers to Next.js
Just wrapped up a solid security hardening session for the MemStack Pro site. Nothing flashy, but these are the kinds of changes that matter when you're shipping a real product.
What Got Done
Added four essential security headers to our Next.js config that now apply across all routes:
Content-Security-Policy - This is the big one. Controls what resources can load and from where. I'm allowing self-hosted content, inline scripts/styles (Next.js needs these), HTTPS images, and data URI fonts. Had to keep unsafe-inline and unsafe-eval for now since Next.js hydration depends on them.
X-Frame-Options: SAMEORIGIN - Prevents our site from being embedded in iframes on other domains. Simple clickjacking protection.
Referrer-Policy: strict-origin-when-cross-origin - Controls how much referrer info gets leaked when users navigate away from our site.
Permissions-Policy - Explicitly disables camera, microphone, and geolocation access. We don't need them, so why leave the door open?
The Implementation
Pretty straightforward Next.js stuff. Added an async headers() function to next.config.js with a /:path* pattern to hit everything universally. The config was basically empty before, so this was a good foundation to build on.
Build passed clean, no errors across our 7 static pages. Always a good feeling when security improvements don't break anything.
Trade-offs and Future Plans
The CSP is a bit permissive right now - allowing unsafe-eval and https: for images/connections. That's the reality of working with Next.js and not wanting to inventory every external resource today. I'd rather ship something secure-ish than get stuck in analysis paralysis.
Next time I'm in this code, I'm thinking about adding X-Content-Type-Options: nosniff and Strict-Transport-Security. Maybe tightening up that CSP once I know exactly what external resources we're actually using.
Shipped it all to master. Sometimes the best sessions are the ones where you just make things more secure without breaking anything.