skills.rest
timothyfroehlich
timothyfroehlichCOMMUNITY
Explore all skills by this author →
GitHub

pinpoint-security

Enforce authentication, input validation, and CSP nonces in Next.js Supabase SSR apps.

Updated Jan 12, 2026
Search Tags:#security#validation#CSP#auth#server-actions#Supabase SSR
One-click install
npx skills add https://github.com/timothyfroehlich/PinPoint-SkillEval --skill pinpoint-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pinpoint-security
Source: https://github.com/timothyfroehlich/PinPoint-SkillEval/tree/main/.claude/skills/pinpoint-security
Command: npx skills add https://github.com/timothyfroehlich/PinPoint-SkillEval --skill pinpoint-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides guidance and patterns to secure web applications by enforcing authentication, robust input validation, CSP headers with nonces, and Supabase SSR integration. It helps teams implement security-conscious development practices across forms, routes, and server actions.

Core Features & Use Cases

  • CSP nonces and security headers: Implement dynamic nonces via middleware and static headers via configuration to prevent XSS.
  • Input validation everywhere: Validate all user inputs and form data using a schema-based approach to prevent injection and data corruption.
  • Supabase SSR security patterns: Use the SSR wrapper and immediate auth checks after creating the client to protect server actions and pages.
  • Auth & authorization discipline: Enforce authorization checks before data access and redirects for unauthenticated users.

Quick Start

Start by integrating the security patterns into your Next.js app: enable middleware for CSP nonces, configure Supabase SSR wrapper, and apply immediate auth checks in server actions.

Frequently Asked Questions about pinpoint-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement CSP nonces and security headers in Next.js middleware?▼

To implement CSP nonces in Next.js, generate a dynamic nonce in your middleware and attach it to security headers to prevent XSS attacks. Static headers can be configured separately in your Next.js configuration.

What is the best way to validate form inputs in Next.js server actions?▼

The best way to validate Next.js server action inputs is using a schema-based validation approach. Applying schema validation to all user inputs and form data prevents injection attacks and data corruption.

How do I secure Supabase SSR data access in Next.js pages?▼

To secure Supabase SSR data access in Next.js, use the Supabase SSR wrapper and perform immediate auth checks immediately after creating the client. This protects server actions and pages from unauthorized access.

Does this approach handle token management for protected routes automatically?▼

Yes, this approach handles token management for protected routes automatically by utilizing middleware-based token management. This ensures secure session handling and redirects for unauthenticated users.

When do I need to enforce authorization checks in a Next.js application?▼

You need to enforce authorization checks in a Next.js application before any data access occurs. Implementing immediate auth checks after client creation ensures unauthenticated users are redirected safely.

Related Skills

Explore More Software Engineering Skills→
kazdenckazdenc
42

supabase-setup

Automate Supabase initialization with schema, RLS, auth, and storage.

Community
Advanced
etylsarinetylsarin
59

security-hardening

Implement authentication, authorization, CSP, input validation, and RLS policies.

Community
Advanced
amo-tech-aiamo-tech-ai

Supabase Database

Manage Supabase migrations, RLS policies, and PostgreSQL functions.

Community
Advanced
BaraArdiwinataBaraArdiwinata

create-api-route

Generate Next.js API routes for Supabase authentication and session management.

Community
Advanced