secure-nextjs-api-routes

Apply composable security middleware to Next.js 13+ App Router routes using the withSecurity wrapper, which enforces authentication, rate limiting via Supabase, CSRF protection, audit logging, and security headers through configurable options like requireAuth, rateLimit, and csrfProtection.

CSRF protection prevents cross-site request forgery attacks by implementing a double-submit cookie pattern that validates requests originate from your application. It's essential for state-changing operations to block unauthorized requests from external sites.

Yes, configure rate limiting through the middleware's rateLimit option, which uses Supabase-backed throttling to restrict abusive clients and protect high-traffic surfaces from overwhelming traffic and denial-of-service attacks.

Enable audit logging through the security middleware to automatically track security events and anomalies on API endpoints, providing visibility into authentication attempts, rate limit violations, and suspicious activity for compliance and incident investigation.

Yes, the middleware applies to both new and existing Next.js 13+ App Router endpoints. Wrap any route requiring security with withSecurity and configure options for allowed methods, body size limits, and other security policies without redesigning your routes.

The middleware enforces best-practice security headers as part of its composable policy enforcement, protecting against common web vulnerabilities and ensuring compliance with security standards across your API routes.