Security Hardening

1---
2name: security-hardening
3description: >
4  Find and fix common security gaps in Next.js apps. Use this skill for security
5  headers, authentication, authorization, Server Actions, API routes, validation,
6  rate limits, dependency checks, and OWASP reviews.
7---
8
9# Security Hardening
10
11> Next.js security hardening, OWASP compliance, and production security checklist
12
13## Metadata
14
15- **Name**: security-hardening
16- **Version**: 1.0.0
17- **Author**: webrenew
18- **Tags**: nextjs, security, owasp, csp, authentication, authorization, xss, csrf, headers
19
20## When to Use
21
22This skill should be used when:
23- Hardening a Next.js application for production deployment
24- Configuring security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy)
25- Implementing authentication and authorization (Auth.js, middleware, RBAC)
26- Securing API routes and Server Actions (input validation, rate limiting, CORS)
27- Preventing data exposure from Server Components to Client Components
28- Setting up dependency security scanning (npm audit, Snyk, Dependabot)
29- Reviewing OWASP Top 10 vulnerabilities specific to Next.js
30- Configuring Vercel-specific security (Firewall, WAF, deployment protection)
31
32## Summary
33
34Comprehensive Next.js security hardening guide covering security headers and CSP with nonces, authentication patterns with Auth.js v5, authorization via Data Access Layer and middleware, Server Action security (CSRF, validation, rate limiting), API route protection, input validation with Zod, XSS and SQL injection prevention, environment variable management, data exposure prevention (server-only, taint API, DTOs), cookie security, middleware-based rate limiting and bot detection, secure error handling, dependency auditing, Vercel security features, OWASP Top 10 mapped to Next.js, and pre-deployment security checklists.