Security Headers

About

Provides automated guidance and implementation patterns for securing web applications through HTTP response headers. This skill facilitates the setup of Content-Security-Policy (CSP) to control resource loading, X-Frame-Options to prevent clickjacking, and Strict-Transport-Security (HSTS) for enforcing HTTPS. Designed primarily for Next.js environments using middleware, it ensures that security features are dynamically configured based on environment variables and third-party integrations like Clerk or Stripe, providing a comprehensive defense-in-depth strategy for modern web development.

Key Features

• Dynamic Content-Security-Policy (CSP) configuration using environment variables
• Implementation of X-Frame-Options: DENY to prevent clickjacking attacks
• 1 GitHub stars
• X-Content-Type-Options: nosniff to mitigate MIME confusion attacks
• Strict-Transport-Security (HSTS) enforcement for production environments
• Search engine indexing control via X-Robots-Tag for protected routes

Use Cases

• Hardening a web application against XSS amplification and data exfiltration
• Securing a Next.js application using middleware to apply global security policies
• Configuring CSP to allow specific third-party integrations like Stripe, Clerk, or Google Analytics