All authentication uses HTTPS TLS 1.2+

Transmitting credentials over unencrypted HTTP exposes every login, password-reset token, and OAuth callback to network interception — a passive attacker on the same Wi-Fi can harvest session tokens in seconds. NIST 800-53 rev5 SC-8 (Transmission Confidentiality) and SC-23 (Session Authenticity) require cryptographic protection for all in-transit data; FedRAMP rev5 makes this a hard requirement for cloud systems handling federal data. CWE-319 and OWASP A02 (Cryptographic Failures) both cite cleartext credential transmission as a direct path to account takeover. Without HSTS, even an HTTPS-capable server remains vulnerable to SSL stripping during the first unprotected request.

Configure HSTS in next.config.js and ensure all OAuth redirect URIs are registered with HTTPS-only hostnames. The minimum max-age for FedRAMP-aligned systems is 31536000 seconds.

// next.config.js
const nextConfig = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          {
            key: 'Strict-Transport-Security',
            value: 'max-age=31536000; includeSubDomains; preload'
          }
        ]
      }
    ]
  }
}
export default nextConfig

Set all OAuth provider callback URLs (Auth0, Clerk, Supabase Auth) to https:// explicitly. Configure your hosting layer (Vercel, AWS CloudFront) to respond with a 301 redirect for any http:// request — do not rely on the application layer alone.