HTTPS is enforced on all payment and checkout pages

Checkout pages accessed over plain HTTP expose payment form data — billing address, card tokenization requests, and order details — to network observers and man-in-the-middle attackers. PCI-DSS 4.0 Req 4.2 mandates that cardholder data in transit be protected with strong cryptography; CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-523 (Unprotected Transport of Credentials) directly apply. OWASP A02 (Cryptographic Failures) treats unencrypted checkout traffic as a critical failure. Even if the card number itself is tokenized via an iframe, HTTP exposes billing address fields, email, and order totals — enough for targeted phishing or order-manipulation attacks.

Enforce HTTPS at the application layer for defense-in-depth, even when your hosting platform handles it automatically.

// middleware.ts — redirect HTTP to HTTPS in production
import { NextResponse, type NextRequest } from 'next/server'

export function middleware(request: NextRequest) {
  if (
    process.env.NODE_ENV === 'production' &&
    request.headers.get('x-forwarded-proto') === 'http'
  ) {
    return NextResponse.redirect(
      `https://${request.headers.get('host')}${request.nextUrl.pathname}`,
      301
    )
  }
  return NextResponse.next()
}

Also set HSTS in next.config.ts to prevent browsers from making HTTP requests in the first place:

{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' }