From 3b1667064ec3ff215b4b7948ab82de7780cba48d Mon Sep 17 00:00:00 2001
From: Jeff <138259519+jdotc1@users.noreply.github.com>
Date: Fri, 13 Nov 2026 12:09:57 -0500
Subject: [PATCH] fix: enforce correct anti-clickjacking headers (#298)

---
 next.config.js                              | 12 ++++++++++++
 src/utils/__tests__/securityHeaders.test.ts | 20 ++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 src/utils/__tests__/securityHeaders.test.ts

diff --git a/next.config.js b/next.config.js
index 6c6e928..38598cc 100644
--- a/next.config.js
+++ b/next.config.js
@@ -5,6 +5,18 @@ const nextConfig = {
   // without needing the full node_modules tree (or a second `npm ci`) copied in.
   output: "standalone",
   turbopack: { root: __dirname },
+  poweredByHeader: false,
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: [
+          { key: "Content-Security-Policy", value: "frame-ancestors 'self'" },
+          { key: "X-Frame-Options", value: "SAMEORIGIN" },
+        ],
+      },
+    ];
+  },
 };
 
 module.exports = nextConfig;
diff --git a/src/utils/__tests__/securityHeaders.test.ts b/src/utils/__tests__/securityHeaders.test.ts
new file mode 100644
index 0000000..21e4378
--- /dev/null
+++ b/src/utils/__tests__/securityHeaders.test.ts
@@ -0,0 +1,20 @@
+import type { NextConfig } from "next";
+
+const nextConfig = require("../../../next.config.js") as NextConfig;
+
+describe("clickjacking response headers", () => {
+  it("sends an enforceable framing policy on every route", async () => {
+    const rules = await nextConfig.headers?.();
+    const everyRoute = rules?.find((rule) => rule.source === "/(.*)");
+    const headers = Object.fromEntries(
+      (everyRoute?.headers ?? []).map(({ key, value }) => [key.toLowerCase(), value]),
+    );
+
+    expect(headers["content-security-policy"]).toContain("frame-ancestors 'self'");
+    expect(headers["x-frame-options"]).toBe("SAMEORIGIN");
+  });
+
+  it("omits the Next.js version disclosure header", () => {
+    expect(nextConfig.poweredByHeader).toBe(false);
+  });
+});