External connections verified and controlled

CMMC 2.0 AC.L1-3.1.20 (NIST 800-171r2 3.1.20) requires that external connections are verified and controlled. A wildcard CORS origin (Access-Control-Allow-Origin: *) allows any website to make credentialed cross-origin requests to your API, exposing session-authenticated FCI endpoints to drive-by exfiltration via CSRF-style attacks. The absence of a Content Security Policy leaves the door open for injected third-party scripts to exfiltrate data from the page. OWASP A05 (Security Misconfiguration) names both as common high-severity misconfigurations. CWE-942 (Overly Permissive Cross-domain Whitelist) applies directly.

Replace wildcard CORS with explicit origin allowlists and add a restrictive CSP in next.config.ts. Both controls are required — AC.L1-3.1.20 is not satisfied by one alone:

// next.config.ts
const nextConfig = {
  async headers() {
    return [
      {
        source: '/api/:path*',
        headers: [
          { key: 'Access-Control-Allow-Origin', value: process.env.ALLOWED_ORIGIN ?? 'https://yourdomain.com' },
          { key: 'Access-Control-Allow-Methods', value: 'GET,POST,PUT,DELETE,OPTIONS' },
          { key: 'Access-Control-Allow-Headers', value: 'Content-Type, Authorization' },
        ],
      },
      {
        source: '/:path*',
        headers: [
          { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'; connect-src 'self' https://api.trusted-service.com" },
        ],
      },
    ]
  },
}
export default nextConfig

Set ALLOWED_ORIGIN in your production environment — never leave it unset or defaulting to *.