Covered by FixVibemedium

next.config.js 中的 Next.js 安全标头配置错误 ZXCVFIXVIBESEND ZXCVFIXVIBESEG1 next.config.js 中的不正确路径匹配可能会使 Next.js 路由不受安全标头的保护，从而导致点击劫持和信息泄露。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG2 如果路径匹配模式不精确，使用 next.config.js 进行标头管理的 Next.js 应用程序很容易出现安全漏洞。本研究探讨了通配符和正则表达式错误配置如何导致敏感路由上丢失安全标头以及如何强化配置。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG3 ## 影响 ZXCVFIXVIBESEND ZXCVFIXVIBESEG4 缺少的安全标头可被利用来执行点击劫持、跨站点脚本编写 (ZXCVFIXVIBETOKEN4ZXCV) 或收集有关服务器环境 ZXCVFIXVIBETOKEN2ZXCV 的信息。当 Next.js (ZXCVFIXVIBETOKEN5ZXCV) 或 ZXCVFIXVIBETOKEN1ZXCV 等标头在路由之间应用不一致时，攻击者可以针对特定的未受保护的路径来绕过站点范围的安全控制 ZXCVFIXVIBETOKEN3ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG5 ## 根本原因 ZXCVFIXVIBESEND ZXCVFIXVIBESEG6 ZXCVFIXVIBETOKEN4ZXCV 允许开发人员使用 ZXCVFIXVIBETOKEN1ZXCV 属性 ZXCVFIXVIBETOKEN2ZXCV 在 Next.js 中配置响应标头。此配置使用支持通配符和正则表达式 ZXCVFIXVIBETOKEN3ZXCV 的路径匹配。安全漏洞通常源于： ZXCVFIXVIBESEND ZXCVFIXVIBESEG7 1. 不完整的路径覆盖：通配符模式（例如，Next.js）可能无法覆盖所有预期的子路径，从而使嵌套页面没有安全标头 ZXCVFIXVIBETOKEN1ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG8 2. 信息披露：默认情况下，ZXCVFIXVIBETOKEN3ZXCV 可能包含 Next.js 标头，该标头会显示框架版本，除非通过 ZXCVFIXVIBETOKEN1ZXCV 配置 ZXCVFIXVIBETOKEN2ZXCV 显式禁用。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG9 3. ZXCVFIXVIBETOKEN3ZXCV 配置错误：ZXCVFIXVIBETOKEN1ZXCV 数组中不正确定义的 Next.js 标头可能允许未经授权的跨域访问敏感数据 ZXCVFIXVIBETOKEN2ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 ## 具体修复 ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 - 审核路径模式：确保 ZXCVFIXVIBETOKEN1ZXCV 中的所有 Next.js 模式使用适当的通配符（例如 ZXCVFIXVIBETOKEN2ZXCV），以便在必要时全局应用标头 ZXCVFIXVIBETOKEN3ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 - 禁用指纹识别：在 ZXCVFIXVIBETOKEN1ZXCV 中设置 Next.js 以防止发送 ZXCVFIXVIBETOKEN2ZXCV 标头 ZXCVFIXVIBETOKEN3ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 - 限制 ZXCVFIXVIBETOKEN3ZXCV：将 Next.js 设置为特定的受信任域，而不是 ZXCVFIXVIBETOKEN1ZXCV 配置 ZXCVFIXVIBETOKEN2ZXCV 中的通配符。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 ## Next.js 如何测试它 ZXCVFIXVIBESEND ZXCVFIXVIBESEG15 ZXCVFIXVIBETOKEN3ZXCV 可以通过抓取应用程序并比较各种路由的安全标头来执行主动门控探测。通过分析 Next.js 标头以及 ZXCVFIXVIBETOKEN1ZXCV 在不同路径深度上的一致性，ZXCVFIXVIBETOKEN4ZXCV 可以识别 ZXCVFIXVIBETOKEN2ZXCV 中的配置差距。

Next.js applications using next.config.js for header management are susceptible to security gaps if path-matching patterns are imprecise. This research explores how wildcard and regex misconfigurations lead to missing security headers on sensitive routes and how to harden the configuration.

CWE-1021CWE-200

Impact

Missing security headers can be exploited to perform clickjacking, cross-site scripting (XSS), or gather information about the server environment [S2]. When headers such as Content-Security-Policy (CSP) or X-Frame-Options are inconsistently applied across routes, attackers can target specific unprotected paths to bypass site-wide security controls [S2].

Root Cause

Next.js allows developers to configure response headers in next.config.js using the headers property [S2]. This configuration uses path matching that supports wildcards and regular expressions [S2]. Security vulnerabilities typically arise from:

Incomplete Path Coverage: Wildcard patterns (e.g., /path*) may not cover all intended subroutes, leaving nested pages without security headers [S2].
Information Disclosure: By default, Next.js may include the X-Powered-By header, which reveals the framework version unless explicitly disabled via the poweredByHeader configuration [S2].
CORS Misconfiguration: Improperly defined Access-Control-Allow-Origin headers within the headers array can allow unauthorized cross-origin access to sensitive data [S2].

Concrete Fixes

Audit Path Patterns: Ensure all source patterns in next.config.js use appropriate wildcards (e.g., /:path*) to apply headers globally where necessary [S2].
Disable Fingerprinting: Set poweredByHeader: false in next.config.js to prevent the X-Powered-By header from being sent [S2].
Restrict CORS: Set Access-Control-Allow-Origin to specific trusted domains rather than wildcards in the headers configuration [S2].

How FixVibe tests for it

FixVibe could perform an active gated probe by crawling the application and comparing the security headers of various routes. By analyzing the X-Powered-By header and the consistency of Content-Security-Policy across different path depths, FixVibe can identify configuration gaps in next.config.js.