Content Security Policy header is present

Without a Content Security Policy, browsers trust every script origin a page loads — including any injected by XSS. An attacker who finds a single injection point can exfiltrate session cookies, rewrite page content, or silently redirect users, because there is no browser-enforced allowlist to stop arbitrary script execution. OWASP A03 (Injection) and CWE-79 (Cross-Site Scripting) both identify missing CSP as a failure to implement available defenses. A Content-Security-Policy-Report-Only header monitors but enforces nothing — it does not satisfy this check. Even a minimal CSP with default-src 'self' eliminates an entire class of exfiltration attacks by blocking off-origin resource loads.

Add an enforcing Content-Security-Policy header to your HTTP responses. Start with a restrictive baseline and loosen only what your app needs:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:

In Next.js next.config.js, add to the headers() array:

{ key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'" }

Test your policy with the CSP Evaluator at https://csp-evaluator.withgoogle.com/ before enforcing. Start in Report-Only mode if you have existing third-party scripts — collect violations, then promote to enforcing.