Missing security headers in Next.js

const securityHeaders = [
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
  {
    key: "Content-Security-Policy",
    value: "frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
  },
];

Return those from the headers() function in next.config. Add HSTS only on the HTTPS deployment:

Strict-Transport-Security: max-age=86400

A full script-src is worth doing, and it is specific to how your app loads scripts. Start with the headers above, then add script rules and click through the app. OWASP's CSP cheat sheet is the reference for the directives. Do not copy a policy from a blog if you have not loaded your pages with it.