Enhance security and caching strategies in Next.js configuration: Updated next.config.ts to implement no-cache headers for auth-sensitive pages and added comprehensive security headers. Removed obsolete favicon and icon files. Refactored layout and page components to disable caching for dynamic content, ensuring proper auth state updates. Improved API route handling for user session management and enhanced error handling in AuthContext.

Author: tenkus47

nextjs/next.config.ts

@@ -117,8 +117,9 @@ const nextConfig: NextConfig = {
   // Enhanced security and SEO headers
   async headers() {
     return [
+      // No cache for main pages that depend on auth state
       {
-        source: "/(.*)",
+        source: "/",
         headers: [
           // Security headers
           {
@@ -145,10 +146,106 @@ const nextConfig: NextConfig = {
             key: "Strict-Transport-Security",
             value: "max-age=31536000; includeSubDomains; preload",
           },
-          // Performance and caching headers
+          // Disable caching for auth-sensitive pages
           {
             key: "Cache-Control",
-            value: "public, max-age=31536000, immutable",
+            value: "no-store, no-cache, must-revalidate, private",
+          },
+          // SEO and crawling headers
+          {
+            key: "X-Robots-Tag",
+            value: "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1",
+          },
+          // Content security headers
+          {
+            key: "Content-Security-Policy",
+            value: [
+              "default-src 'self'",
+              "script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://cdn.auth0.com https://vercel.live",
+              "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+              "img-src 'self' data: blob: https: http:",
+              "font-src 'self' https://fonts.gstatic.com",
+              "connect-src 'self' https://api.pecha-tools.com https://www.google-analytics.com https://vercel.live wss://vercel.live",
+              "frame-src 'self' https://www.youtube.com https://player.vimeo.com",
+              "media-src 'self' https:",
+              "object-src 'none'",
+              "base-uri 'self'",
+              "form-action 'self'",
+              "frame-ancestors 'none'",
+              "upgrade-insecure-requests",
+            ].join("; "),
+          },
+        ],
+      },
+      // No cache for auth-related pages
+      {
+        source: "/(login|logout|profile|admin|dashboard)/:path*",
+        headers: [
+          // Security headers
+          {
+            key: "X-Frame-Options",
+            value: "DENY",
+          },
+          {
+            key: "X-Content-Type-Options",
+            value: "nosniff",
+          },
+          {
+            key: "X-XSS-Protection",
+            value: "1; mode=block",
+          },
+          {
+            key: "Referrer-Policy",
+            value: "strict-origin-when-cross-origin",
+          },
+          {
+            key: "Permissions-Policy",
+            value: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()",
+          },
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=31536000; includeSubDomains; preload",
+          },
+          // Disable caching for auth pages
+          {
+            key: "Cache-Control",
+            value: "no-store, no-cache, must-revalidate, private",
+          },
+        ],
+      },
+      // Cache for other pages
+      {
+        source: "/((?!api|_next/static|_next/image|favicon.ico|login|logout|profile|admin|dashboard).*)",
+        headers: [
+          // Security headers
+          {
+            key: "X-Frame-Options",
+            value: "DENY",
+          },
+          {
+            key: "X-Content-Type-Options",
+            value: "nosniff",
+          },
+          {
+            key: "X-XSS-Protection",
+            value: "1; mode=block",
+          },
+          {
+            key: "Referrer-Policy",
+            value: "strict-origin-when-cross-origin",
+          },
+          {
+            key: "Permissions-Policy",
+            value: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()",
+          },
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=31536000; includeSubDomains; preload",
+          },
+          // Performance and caching headers for non-auth pages
+          {
+            key: "Cache-Control",
+            value: "public, max-age=3600, stale-while-revalidate=86400",
           },
           // SEO and crawling headers
           {

nextjs/public/favicon.ico

@@ -34,8 +34,6 @@ const afterCallback = async (req: any, session: any, config: any) => {
             };
 
           }
-        } else {
-          console.log("⚠️ No access token found in session, using basic user data");
         }
 
 
@@ -70,12 +68,8 @@ const afterCallback = async (req: any, session: any, config: any) => {
           accessToken: session.accessToken
         };
 
-        console.log("✅ User session enhanced with DB data:", {
-          id: user.id,
-          email: user.email,
-          role: user.role,
-          isAdmin: user.isAdmin
-        });
+   
+
 
     } catch (error) {
       console.error("❌ Auth callback failed:", error);
@@ -95,7 +89,7 @@ const handler = handleAuth({
         }
     }),
     logout: handleLogout({
-        returnTo: process.env.AUTH0_BASE_URL
+        returnTo: `${process.env.AUTH0_BASE_URL}/`
     }),
     callback: handleCallback({
         afterCallback: afterCallback,

nextjs/public/icon.png

@@ -1,18 +1,26 @@
 import { NextResponse } from "next/server";
 import { getSession } from "@auth0/nextjs-auth0";
+import { NextRequest } from "next/server";
 
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
-    const session = await getSession();
+    const session = await getSession(request);
 
-    return NextResponse.json({
+    const response = NextResponse.json({
       hasSession: !!session,
       hasUser: !!session?.user,
       userSub: session?.user?.sub,
       sessionKeys: session ? Object.keys(session) : [],
       userKeys: session?.user ? Object.keys(session.user) : [],
       timestamp: new Date().toISOString()
     });
+
+    // Disable caching for auth endpoints
+    response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
+    response.headers.set('Pragma', 'no-cache');
+    response.headers.set('Expires', '0');
+    
+    return response;
   } catch (error: any) {
     return NextResponse.json({
       error: "Failed to get session",

nextjs/public/img/icon_logo.png

@@ -1,16 +1,47 @@
-import { NextRequest, NextResponse } from "next/server";
-import { verifyToken, createErrorResponse } from "@/lib/auth";
+import { NextResponse } from "next/server";
+import { getSession } from "@auth0/nextjs-auth0";
+import { NextRequest } from "next/server";
 
 export async function GET(request: NextRequest) {
   try {
-    const authResult = await verifyToken(request);
+    const session = await getSession(request);
+    
+    if (!session || !session.user) {
+      return NextResponse.json(
+        { error: "No authenticated user found" },
+        { status: 401 }
+      );
+    }
 
-    return NextResponse.json({
-      id: authResult.sub,
-      email: authResult["https://pecha-tool/email"],
-      picture: authResult["https://pecha-tool/picture"],
+    // Return the user data from the session
+    const user = session.user;
+    
+    const response = NextResponse.json({
+      id: user.sub,
+      email: user.customEmail || user.email,
+      name: user.name,
+      picture: user.customPicture || user.picture,
+      role: user.role || 'USER',
+      isAdmin: user.isAdmin || false,
+      // Include additional fields that might be useful
+      dbUser: user.dbUser,
+      timestamp: new Date().toISOString()
     });
-  } catch (error) {
-    return createErrorResponse("Unauthorized", 401);
+
+    // Disable caching for auth endpoints
+    response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
+    response.headers.set('Pragma', 'no-cache');
+    response.headers.set('Expires', '0');
+    
+    return response;
+  } catch (error: any) {
+    console.error("Error fetching user from session:", error);
+    return NextResponse.json(
+      { 
+        error: "Failed to fetch user data",
+        message: error.message 
+      },
+      { status: 500 }
+    );
   }
-}
+}

nextjs/src/app/api/auth/[...auth0]/route.ts

@@ -9,6 +9,9 @@ import {
   organizationData,
 } from "@/components/ServerStructuredData";
 
+// Disable caching to ensure auth state updates properly
+export const dynamic = 'force-dynamic';
+
 const geistSans = Geist({
   variable: "--font-geist-sans",
   subsets: ["latin"],

nextjs/src/app/api/auth/me/route.ts

@@ -10,6 +10,10 @@ import { homeMetadata } from "@/lib/metadata";
 
 export const metadata = homeMetadata;
 
+// Disable caching for this page to ensure auth state updates properly
+export const dynamic = 'force-dynamic';
+export const revalidate = 0;
+
 export default function Home() {
   return (
     <>