fix(security): correct clickjacking headers for web routes

next.config.js

@@ -5,6 +5,18 @@ const nextConfig = {
   // without needing the full node_modules tree (or a second `npm ci`) copied in.
   output: "standalone",
   turbopack: { root: __dirname },
+  poweredByHeader: false,
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: [
+          { key: "Content-Security-Policy", value: "frame-ancestors 'self'" },
+          { key: "X-Frame-Options", value: "SAMEORIGIN" },
+        ],
+      },
+    ];
+  },
 };
 
 module.exports = nextConfig;

src/utils/__tests__/securityHeaders.test.ts

@@ -0,0 +1,20 @@
+import type { NextConfig } from "next";
+
+const nextConfig = require("../../../next.config.js") as NextConfig;
+
+describe("clickjacking response headers", () => {
+  it("sends an enforceable framing policy on every route", async () => {
+    const rules = await nextConfig.headers?.();
+    const everyRoute = rules?.find((rule) => rule.source === "/(.*)");
+    const headers = Object.fromEntries(
+      (everyRoute?.headers ?? []).map(({ key, value }) => [key.toLowerCase(), value]),
+    );
+
+    expect(headers["content-security-policy"]).toContain("frame-ancestors 'self'");
+    expect(headers["x-frame-options"]).toBe("SAMEORIGIN");
+  });
+
+  it("omits the Next.js version disclosure header", () => {
+    expect(nextConfig.poweredByHeader).toBe(false);
+  });
+});