Covered by FixVibemedium

next.config.js 中的 Next.js 安全標頭配置錯誤 ZXCVFIXVIBESEND ZXCVFIXVIBESEG1 next.config.js 中的不正確路徑匹配可能會使 Next.js 路由不受安全標頭的保護，從而導致點擊劫持和資訊外洩。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG2 如果路徑匹配模式不精確，使用 next.config.js 進行標頭管理的 Next.js 應用程式很容易出現安全漏洞。本研究探討了通配符和正規表示式錯誤配置如何導致敏感路由上遺失安全標頭以及如何強化配置。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG3 ## 影響 ZXCVFIXVIBESEND ZXCVFIXVIBESEG4 缺少的安全標頭可被利用來執行點擊劫持、跨站點腳本編寫 (ZXCVFIXVIBETOKEN4ZXCV) 或收集有關伺服器環境 ZXCVFIXVIBETOKEN2ZXCV 的資訊。當 Next.js (ZXCVFIXVIBETOKEN5ZXCV) 或 ZXCVFIXVIBETOKEN1ZXCV 等標頭在路由之間應用不一致時，攻擊者可以針對特定的未受保護的路徑來繞過站點範圍的安全控制 ZXCVFIXVIBETOKEN3ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG5 ## 根本原因 ZXCVFIXVIBESEND ZXCVFIXVIBESEG6 ZXCVFIXVIBETOKEN4ZXCV 讓開發人員可以使用 ZXCVFIXVIBETOKEN1ZXCV 屬性 ZXCVFIXVIBETOKEN2ZXCV 在 Next.js 中配置反應標頭。此配置使用支援通配符和正規表示式 ZXCVFIXVIBETOKEN3ZXCV 的路徑匹配。安全漏洞通常源自於： ZXCVFIXVIBESEND ZXCVFIXVIBESEG7 1. 不完整的路徑覆蓋：通配符模式（例如，Next.js）可能無法覆蓋所有預期的子路徑，從而使嵌套頁面沒有安全標頭 ZXCVFIXVIBETOKEN1ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG8 2. 資訊揭露：預設情況下，ZXCVFIXVIBETOKEN3ZXCV 可能包含 Next.js 標頭，此標頭會顯示框架版本，除非透過 ZXCVFIXVIBETOKEN1ZXCV 配置 ZXCVFIXVIBETOKEN2ZXCV 明確停用。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG9 3. ZXCVFIXVIBETOKEN3ZXCV 配置錯誤：ZXCVFIXVIBETOKEN1ZXCV 數組中不正確定義的 Next.js 標頭可能允許未經授權的跨域存取敏感資料 ZXCVFIXVIBETOKEN2ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 ## 具體修復 ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 - 審核路徑模式：確保 ZXCVFIXVIBETOKEN1ZXCV 中的所有 Next.js 模式使用適當的通配符（例如 ZXCVFIXVIBETOKEN2ZXCV），以便在必要時全域應用標頭 ZXCVFIXVIBETOKEN3ZX。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 - 禁用指纹识别：在 ZXCVFIXVIBETOKEN1ZXCV 中设置 Next.js 以防止发送 ZXCVFIXVIBETOKEN2ZXCV 标头 ZXCVFIXVIBETOKEN3ZXCV。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 - 限制 ZXCVFIXVIBETOKEN3ZXCV：將 Next.js 設定為特定的受信任域，而不是 ZXCVFIXVIBETOKEN1ZXCV 設定 ZXCVFIXVIBETOKEN2ZXCV 中的通配符。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 ## Next.js 如何測試它 ZXCVFIXVIBESEND ZXCVFIXVIBESEG15 ZXCVFIXVIBETOKEN3ZXCV 可以透過抓取應用程式並比較各種路由的安全標頭來執行主動門控探測。透過分析 Next.js 標頭以及 ZXCVFIXVIBETOKEN1ZXCV 在不同路徑深度上的一致性，ZXCVFIXVIBETOKEN4ZXCV 可以識別 ZXCVFIXVIBETOKEN2ZXCV 的配置差距。

Next.js applications using next.config.js for header management are susceptible to security gaps if path-matching patterns are imprecise. This research explores how wildcard and regex misconfigurations lead to missing security headers on sensitive routes and how to harden the configuration.

CWE-1021CWE-200

Impact

Missing security headers can be exploited to perform clickjacking, cross-site scripting (XSS), or gather information about the server environment [S2]. When headers such as Content-Security-Policy (CSP) or X-Frame-Options are inconsistently applied across routes, attackers can target specific unprotected paths to bypass site-wide security controls [S2].

Root Cause

Next.js allows developers to configure response headers in next.config.js using the headers property [S2]. This configuration uses path matching that supports wildcards and regular expressions [S2]. Security vulnerabilities typically arise from:

Incomplete Path Coverage: Wildcard patterns (e.g., /path*) may not cover all intended subroutes, leaving nested pages without security headers [S2].
Information Disclosure: By default, Next.js may include the X-Powered-By header, which reveals the framework version unless explicitly disabled via the poweredByHeader configuration [S2].
CORS Misconfiguration: Improperly defined Access-Control-Allow-Origin headers within the headers array can allow unauthorized cross-origin access to sensitive data [S2].

Concrete Fixes

Audit Path Patterns: Ensure all source patterns in next.config.js use appropriate wildcards (e.g., /:path*) to apply headers globally where necessary [S2].
Disable Fingerprinting: Set poweredByHeader: false in next.config.js to prevent the X-Powered-By header from being sent [S2].
Restrict CORS: Set Access-Control-Allow-Origin to specific trusted domains rather than wildcards in the headers configuration [S2].

How FixVibe tests for it

FixVibe could perform an active gated probe by crawling the application and comparing the security headers of various routes. By analyzing the X-Powered-By header and the consistency of Content-Security-Policy across different path depths, FixVibe can identify configuration gaps in next.config.js.