[BUG]: Custom Security Headers Overwritten by CSP Headers in next.config.js
Description
In next.config.js, a set of secure HTTP response headers (such as X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, and endpoint rate-limiting info) is defined inside nextConfig.headers().
However, later in the script, the nextConfig.headers export is reassigned to apply a Content Security Policy (CSP) for Google Fonts, completely overwriting and discarding the previous security configuration.
Locations affected
Code Snippet
At line 96:
async headers() {
return [
{
source: '/(.*)',
headers: [
{ key: 'X-Frame-Options', value: 'DENY' },
...
]
}
];
}At line 159, this is completely overwritten:
nextConfig.headers = async () => {
return [
{
source: '/(.*)',
headers: [
{
key: 'Content-Security-Policy',
value: "...",
},
],
},
]
}Expected Behavior
Both the CSP headers and the security headers (X-Frame-Options, X-Content-Type-Options, etc.) should be merged and returned together.
Proposed Solution
Combine both arrays of headers under the original headers() function inside nextConfig rather than assigning a new function to nextConfig.headers.
[BUG]: Custom Security Headers Overwritten by CSP Headers in next.config.js
Description
In
next.config.js, a set of secure HTTP response headers (such asX-Frame-Options,X-Content-Type-Options,X-XSS-Protection, and endpoint rate-limiting info) is defined insidenextConfig.headers().However, later in the script, the
nextConfig.headersexport is reassigned to apply a Content Security Policy (CSP) for Google Fonts, completely overwriting and discarding the previous security configuration.Locations affected
Code Snippet
At line 96:
At line 159, this is completely overwritten:
Expected Behavior
Both the CSP headers and the security headers (
X-Frame-Options,X-Content-Type-Options, etc.) should be merged and returned together.Proposed Solution
Combine both arrays of headers under the original
headers()function insidenextConfigrather than assigning a new function tonextConfig.headers.