Безопасность продакшена

const nextConfig = {
    async headers() {
        return [
            {
                source: '/(.*)',
                headers: [
                    { key: 'X-Content-Type-Options', value: 'nosniff' },
                    { key: 'X-Frame-Options', value: 'DENY' },
                    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
                    { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
                    {
                        key: 'Strict-Transport-Security',
                        value: 'max-age=63072000; includeSubDomains; preload',
                    },
                ],
            },
        ];
    },
};

{
    key: 'Content-Security-Policy',
    value: [
        "default-src 'self'",
        "script-src 'self' 'unsafe-inline' https://vercel.live",
        "style-src 'self' 'unsafe-inline'",
        "img-src 'self' data: https:",
        "font-src 'self' data:",
        "connect-src 'self' https://api.example.com",
        "frame-ancestors 'none'",
    ].join('; '),
}

{
    key: 'Content-Security-Policy-Report-Only',
    value: "...",
}

export async function POST(request: Request) {
    const origin = request.headers.get('origin');

    if (origin !== process.env.APP_URL) {
        return Response.json({ error: 'Invalid origin' }, { status: 403 });
    }

    // обработка
}

cookieStore.set('token', value, { sameSite: 'strict' });

cookieStore.set('token', value, {
    httpOnly: true,                                 // недоступно из JS
    secure: process.env.NODE_ENV === 'production', // только HTTPS
    sameSite: 'lax',                               // защита от CSRF
    maxAge: 60 * 60 * 24 * 7,
    path: '/',
});

await db.post.findMany({ where: { title: search } });

// Плохо
await db.$queryRawUnsafe(`SELECT * FROM users WHERE email = '${email}'`);

// Хорошо
await db.$queryRaw`SELECT * FROM users WHERE email = ${email}`;

// Опасно
<div dangerouslySetInnerHTML={{ __html: userInput }} />

// Безопасно
<div>{userInput}</div>

npm install dompurify isomorphic-dompurify

import DOMPurify from 'isomorphic-dompurify';

<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />

npm install @upstash/ratelimit @upstash/redis

import { Ratelimit } from '@upstash/ratelimit';
import { Redis } from '@upstash/redis';

const ratelimit = new Ratelimit({
    redis: Redis.fromEnv(),
    limiter: Ratelimit.slidingWindow(10, '10 s'),
});

export async function POST(request: Request) {
    const ip = request.headers.get('x-forwarded-for') ?? 'unknown';
    const { success } = await ratelimit.limit(ip);

    if (!success) {
        return Response.json({ error: 'Too many requests' }, { status: 429 });
    }

    // обработка
}

const schema = z.object({
    email: z.string().email(),
    password: z.string().min(8),
});

const result = schema.safeParse(await request.json());
if (!result.success) {
    return Response.json({ errors: result.error.flatten() }, { status: 422 });
}

npm install bcryptjs

import bcrypt from 'bcryptjs';

const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);

npm audit
npm audit fix

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly