skills.rest
zzafergok
zzafergokCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

nextjs-security

Implements and audits security controls for Next.js applications covering authentication, input validation, and privacy compliance.

1|Updated Aug 7, 2025
Search Tags:#OWASP#security#authentication#input validation#rate limiting#GDPR#nextjs
One-click install
npx skills add https://github.com/zzafergok/arktos --skill nextjs-security-zzafergok
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nextjs-security
Source: https://github.com/zzafergok/arktos/tree/main/.agent/skills/nextjs-security
Command: npx skills add https://github.com/zzafergok/arktos --skill nextjs-security-zzafergok

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building secure Next.js applications requires consistent enforcement of authentication, authorization, input validation, and data privacy rules, and missing any one of them can expose user data or create exploitable vulnerabilities. ## Core Features & Use Cases - Security Pattern Guidance: Provides concrete rules for secrets management, SQL injection prevention, XSS and CSRF protection, rate limiting, and safe error handling. - Privacy & GDPR Coverage: Defines requirements for consent tracking, data export, data deletion, retention policies, and data minimization. - Pre-Deployment Audit Checklist: Offers a structured checklist to verify application security, privacy compliance, and cryptographic safety before release. - Use Case: Before shipping a Next.js app with user accounts and payments, use this Skill to audit your API routes, cookie configuration, and file upload handling against OWASP-aligned practices. ## Quick Start Audit my Next.js API routes and authentication flow for security vulnerabilities and GDPR compliance gaps.

Frequently Asked Questions about nextjs-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure API routes in Next.js?▼

Secure Next.js API routes by validating all input with schemas like Zod, authenticating before processing logic, and authorizing before accessing resources. Apply rate limiting to public endpoints and return generic error messages without stack traces.

What is the best way to store auth tokens in Next.js?▼

Store authentication tokens in httpOnly cookies with Secure and SameSite=Strict flags, never in localStorage. Implement session expiration and rotation, and always enforce authorization checks on the server rather than the frontend.

How do I handle file uploads securely in Next.js?▼

Restrict file size to a defined limit such as 5MB, validate both MIME type and file extension, and never trust the file name alone. Treat all uploaded content as untrusted input.

Does Next.js security guidance cover GDPR compliance?▼

Yes, it covers GDPR requirements including consent tracking with timestamps, data export and deletion endpoints, retention periods with automatic purging, and data minimization. It is guidance only, not a compliance certification.

Why should CSRF protection be enabled for cookie-based auth?▼

Cookie-based authentication is vulnerable to cross-site request forgery because browsers attach cookies automatically. Protect all state-changing requests with CSRF tokens and set cookies with SameSite=Strict or Lax.

Related Skills

Explore More Software Engineering Skills→
Aqsagull99Aqsagull99

better-auth-skill

Configure Better Auth authentication for Next.js applications with session management and secure cookies.

Community
Advanced
JEO-tech-aiJEO-tech-ai
8

security-best-practices

Harden Express.js web applications with OWASP-aligned security configurations.

Community
Advanced
proffesor-for-testingproffesor-for-testing
436

security-testing

Test software security vulnerabilities using OWASP principles.

Community
Advanced
MeechYourGoalsMeechYourGoals
2

chravel-supabase-rls

Audit and implement Supabase Row-Level Security policies with auth.uid().

Community
Advanced