Next.js fixes
22 guides include a Next.js section. This page only lists those sections. It is not a copy of the full catalog, and a sponsor does not change which guides appear or their order.
- criticalUpdated Oct 12, 2026
Auth checked only in the UI in Next.js
In every Route Handler and Server Action that reads or writes user data, load the session from cookies or from your auth library on the server, and stop when there is no user. Do the same for admin actions with an explicit role check stored somewhere the user cannot edit.
- criticalUpdated Oct 12, 2026
Exposed .env files and debug endpoints in Next.js
Delete debug routes or guard them so they cannot run in production. Prefer deleting them.
- criticalUpdated Oct 12, 2026
Firebase rules left open in Next.js
If an Admin SDK service account is used on the server, rules do not apply to that SDK. Check the session in the Route Handler, the same as a Supabase secret key.
- criticalUpdated Oct 12, 2026
IDOR: reading or changing someone else's data in Next.js
Take the user id from the session. Use the object's id from the URL only as a lookup inside that user's rows.
- criticalUpdated Oct 12, 2026
Keys committed to GitHub in Next.js
Read secrets from the environment at runtime on the server. Do not default them in source code "for local dev." Use .env.local , which Next.js gitignores in a typical app, and keep .env.example free of real values.
- criticalUpdated Oct 12, 2026
No cap on LLM API spend in Next.js
ts const DAILY LIMIT = 20;
- criticalUpdated Oct 12, 2026
Open storage buckets in Next.js
The route that mints a signed URL has to authenticate the caller and authorize the path. A route that signs whatever ?path= it receives is an IDOR.
- criticalUpdated Oct 12, 2026
Secret keys shipped in the frontend in Next.js
Assume every NEXT PUBLIC value is public. Do not pass a secret as a prop into a client component.
- criticalUpdated Oct 12, 2026
Server Actions with no auth check in Next.js
ts "use server";
- criticalUpdated Oct 12, 2026
Supabase tables without row level security in Next.js
If a Server Component or Route Handler uses the secret key, RLS does not run. Filter by the signed-in user's id in that query, or stop using the secret key for ordinary user requests and use the publishable key plus the user's session so RLS applies.
- criticalUpdated Oct 12, 2026
The client sets the price, role, or plan in Next.js
Assign fields explicitly:
- criticalUpdated Oct 12, 2026
Unverified Stripe webhooks in Next.js
ts import Stripe from "stripe";
- highUpdated Oct 12, 2026
CORS wide open in Next.js
ts const allowed = new Set([ "https://your-app.example", ]);
- highUpdated Oct 12, 2026
Cross-site scripting (XSS) in Next.js
Render user text as text. If you need formatting, use a markdown renderer that does not pass raw HTML through, or sanitize with a maintained HTML sanitizer and a strict allowlist (no script , no event handlers, no javascript: URLs).
- highUpdated Oct 12, 2026
No rate limiting on auth or paid API routes in Next.js
Before the expensive call, reject when this user or IP has exceeded a small budget for the window. Store the count in Redis, your database, or a rate-limit service.
- highUpdated Oct 12, 2026
Prompt injection in LLM features in Next.js
Keep the system instruction in a fixed string you wrote. Pass user content and retrieved documents as separate user or tool messages, and wrap them in a delimiter you tell the model is data.
- highUpdated Oct 12, 2026
SQL injection in Next.js
With Prisma, use the tagged template prisma.$queryRaw , which parameterizes interpolations. Do not use $queryRawUnsafe with a built string.
- highUpdated Oct 12, 2026
Unsafe file uploads in Next.js
Limit size before you buffer the whole file. Allow a short list of types you actually need (for example PNG, JPEG, WebP).
- highUpdated Oct 12, 2026
Weak password reset in Next.js
If you implement reset yourself because you hash passwords in your own table:
- mediumUpdated Oct 13, 2026
Missing privacy policy and terms in Next.js
Add two routes, /privacy and /terms , linked from the footer on every page including signup. Write them from the data you actually collect.
- mediumUpdated Oct 12, 2026
Missing security headers in Next.js
- mediumUpdated Oct 12, 2026
Outdated dependencies in Next.js
Update the framework and the packages your routes import first. Rebuild and click through login, checkout, and a write to the database.
How an entry gets onto a platform page is described in the editorial standards.