NextJS Security Best Practices Syllabus

In the Next.js App Router, what are the main techniques for protecting an API Route Handler?

Read the session with auth()/getServerSession at the start of the handler, verify the user is authenticated and authorized (role/permission check), and return a 401 or 403 response early if the check fails before executing any logic.

What is the difference between HTTP status codes 401 and 403 when protecting API routes?

401 Unauthorized means the request lacks valid authentication credentials (not logged in / invalid token). 403 Forbidden means the user is authenticated but not permitted to access the resource (insufficient privileges).

What role does Next.js Middleware play in protecting routes, and what is one important limitation?

Middleware runs before a request reaches a route and can redirect or block unauthenticated users centrally. A limitation is that it runs on the Edge runtime and should do lightweight checks; heavy DB-based authorization is better done in the route/handler itself.

Why must every protected API route independently verify authorization even if a page is already gated?

Because API routes can be called directly (e.g. via fetch/curl) without going through the protected page. Each endpoint is its own entry point and must enforce its own auth checks; page-level protection does not secure the underlying API.

When accepting input in a protected API route, why is input validation still a security requirement?

Authorization confirms who may call the endpoint, but authenticated users can still send malicious or malformed data. Validating/sanitizing input (e.g. with a schema like Zod) prevents injection, over-posting, and data-integrity attacks.

What is 'sensitive data' in the security context, and give three examples.

Data that, if disclosed, could harm an individual or organization. Examples: passwords/credentials, personally identifiable information (PII) like SSNs, and financial data such as credit card numbers or API keys/secrets.

Why should passwords be hashed rather than encrypted for storage?

Hashing is a one-way function, so stored hashes cannot be reversed to reveal the password even if the database is breached, whereas encryption is reversible with the key. Verification is done by hashing the input and comparing hashes.

What is a salt in password hashing, and what attack does it defend against?

A salt is a unique random value added to each password before hashing. It ensures identical passwords produce different hashes, defeating precomputed rainbow-table attacks and making bulk cracking harder.

Name three password-hashing algorithms designed to be deliberately slow/resource-intensive, and explain why slowness helps.

bcrypt, scrypt, and Argon2. Their deliberate computational cost (work factor) slows brute-force and dictionary attacks by limiting how many guesses an attacker can compute per second.

In Next.js, why should secrets like database URLs and API keys use environment variables WITHOUT the NEXT_PUBLIC_ prefix?

Variables prefixed with NEXT_PUBLIC_ are inlined into the client bundle and exposed to the browser. Secrets must omit that prefix so they remain server-only and are never shipped to the client.

What is the difference between encryption at rest and encryption in transit?

Encryption at rest protects stored data (e.g. database/disk encryption) from attackers who gain storage access. Encryption in transit protects data moving over a network (e.g. via TLS/HTTPS) from interception/eavesdropping.

What is data minimization and why is it a security best practice for handling sensitive data?

It is the practice of collecting, processing, and retaining only the data strictly necessary for a purpose. Less stored sensitive data means a smaller attack surface and reduced impact if a breach occurs.

What does HTTPS provide over HTTP, in terms of the CIA security properties?

HTTPS layers TLS over HTTP to provide confidentiality (encryption of traffic), integrity (detection of tampering), and authentication (verifying the server's identity via its certificate).

What protocol underlies HTTPS today, and what replaced the older SSL?

TLS (Transport Layer Security) underlies HTTPS. TLS replaced the deprecated SSL protocol; modern deployments use TLS 1.2 or TLS 1.3.

During a TLS handshake, how are asymmetric and symmetric cryptography combined?

Asymmetric cryptography is used to authenticate the server and securely agree on a shared secret (key exchange). That shared secret then keys fast symmetric encryption for the bulk of the session data.

What is the HTTP Strict-Transport-Security (HSTS) header and what does it enforce?

It is a response header (Strict-Transport-Security) that instructs browsers to only connect to the site over HTTPS for a specified max-age, preventing protocol-downgrade and SSL-stripping man-in-the-middle attacks.

What does a TLS/SSL certificate authority (CA) do, and why does it matter for HTTPS trust?

A CA is a trusted third party that verifies a domain owner's identity and issues a signed certificate. Browsers trust certificates chaining to a known CA, which is how they confirm they are talking to the genuine server and not an impostor.

What is a security audit in the context of application security?

A systematic review of an application's code, configuration, dependencies, and infrastructure against security standards to identify vulnerabilities, misconfigurations, and compliance gaps, producing findings and remediation recommendations.

Contrast static application security testing (SAST) with dynamic application security testing (DAST).

SAST analyzes source code/binaries without executing them to find flaws early (white-box). DAST tests the running application from the outside by sending requests to find runtime vulnerabilities (black-box).

What is penetration testing and how does it differ from a routine vulnerability scan?

Penetration testing is an authorized simulated attack where testers actively exploit weaknesses to demonstrate real impact. A vulnerability scan merely automatically enumerates known potential weaknesses without exploiting them.

Why are regular (recurring) security audits important rather than a single one-time review?

Because code, dependencies, threats, and configurations continually change; new vulnerabilities are disclosed over time. Recurring audits catch regressions and newly introduced or newly discovered flaws that a one-time review would miss.

What is the purpose of maintaining audit logs, and what should they capture for security?

Audit logs create a tamper-evident record of who did what and when, supporting incident detection, forensics, and accountability. They should capture authentication events, authorization decisions, and access to sensitive resources with timestamps and actor identities.

What does the Content-Security-Policy (CSP) header do, and which major attack class does it mitigate?

CSP restricts which sources the browser may load scripts, styles, images, etc. from. It primarily mitigates cross-site scripting (XSS) by blocking execution of unauthorized/inline scripts.

What is the purpose of the X-Content-Type-Options: nosniff header?

It tells the browser not to MIME-sniff a response away from its declared Content-Type, preventing attackers from getting content interpreted as an executable script when it was served as another type.

What does the X-Frame-Options (or CSP frame-ancestors) header protect against?

It controls whether the site can be embedded in an iframe, defending against clickjacking attacks where a malicious site frames your page and tricks users into unintended clicks.

How can you set global security headers in a Next.js application?

By defining a headers() function in next.config.js that returns header key/value pairs for matching source paths (e.g. adding CSP, HSTS, X-Content-Type-Options), or by setting them in middleware for dynamic responses.

What is Cross-Origin Resource Sharing (CORS) and why should it be configured restrictively?

CORS is a browser mechanism using response headers (e.g. Access-Control-Allow-Origin) to control which origins may read cross-origin responses. It should be restricted to trusted origins so untrusted sites cannot make authenticated cross-origin requests to your API.

What is a supply-chain attack in the context of dependency management, and give an example vector.

An attack that compromises software through its third-party dependencies rather than the app's own code. Example vectors: a maintainer publishing a malicious package version, typosquatting a popular package name, or a hijacked/compromised npm account injecting malware.

What does the `npm audit` command do, and what is one of its limitations?

It scans a project's dependency tree against a vulnerability advisory database and reports known vulnerable packages with severity and fix guidance. A limitation is that it only flags publicly known CVEs/advisories and may produce false positives or miss unreported/zero-day issues.

What is the purpose of a lockfile (e.g. package-lock.json) for dependency security?

It pins the exact resolved versions and integrity hashes of every dependency, ensuring reproducible installs and preventing unexpected or tampered versions from being silently pulled in across environments.

In semantic versioning (MAJOR.MINOR.PATCH), what do the caret (^) and tilde (~) range specifiers allow, and why does this matter for security?

The caret (^1.2.3) allows updates that do not change the leftmost non-zero digit (minor and patch). The tilde (~1.2.3) allows only patch updates. This matters because loose ranges can pull in a newly published malicious minor/patch version, so pinning plus a lockfile reduces that risk.