HTTP Security Headers & X-Frame-Options
Shield your web applications against clickjacking, MIME sniffing, and protocol downgrade attacks. Configure and export headers for Next.js, Nginx, and Apache.
Controls whether browsers allow this site to be embedded inside an <iframe>.
Forces modern browsers to always connect via HTTPS, preventing SSL stripping MITM attacks.
Stops browsers from MIME-sniffing a response away from the declared Content-Type.
// next.config.mjs
/** @type {import('next').NextConfig} */
const nextConfig = {
async headers() {
return [
{
source: '/:path*',
headers: [
{ key: 'X-Frame-Options', value: 'DENY' },
{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains; preload' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
{ key: 'Cross-Origin-Opener-Policy', value: 'same-origin' },
{ key: 'Cross-Origin-Resource-Policy', value: 'same-origin' }
],
},
];
},
};
export default nextConfig;Essential HTTP Security Headers Every Production Web App Needs
Understanding Clickjacking & X-Frame-Options (DENY vs SAMEORIGIN)
In a clickjacking (UI redress) attack, a malicious website embeds your application in a transparent iframe beneath an enticing decoy button (like "Claim Free Prize"). When the user clicks the decoy, they unknowingly click a button inside your authenticated application (such as "Delete Account" or "Authorize Payment").
Setting X-Frame-Options: DENY instructs modern browsers never to render the page inside any frame. SAMEORIGIN allows framing only if the parent site has the exact same origin. (Note: In CSP Level 2/3, frame-ancestors 'none' supersedes X-Frame-Options).
HSTS & X-Content-Type-Options: Why They Are Mandatory
Strict-Transport-Security (HSTS): Prevents man-in-the-middle attacks that downgrade HTTPS requests to insecure HTTP. With max-age=31536000; includeSubDomains; preload, browsers will refuse to load any unencrypted assets.
X-Content-Type-Options: nosniff: Prevents Internet Explorer, Chrome, and Safari from executing uploaded user files (like images with hidden scripts) as JavaScript when MIME types are misconfigured.