nextjs - 💡(How to fix) Fix [Bug] NEXT_PRIVATE_TEST_HEADERS env var disables all internal header filtering [1 comments, 2 participants]

TL;DR

To prevent internal headers from being passed through unfiltered, ensure the NEXT_PRIVATE_TEST_HEADERS environment variable is not set in production environments.

Guidance

• Verify that the NEXT_PRIVATE_TEST_HEADERS environment variable is not set in your production environment to prevent security risks.
• Consider adding a check at startup to warn when this variable is detected in a production environment (NODE_ENV=production).
• Review your deployment pipeline and CI/CD configuration to ensure this variable is not accidentally set.
• Document clearly that NEXT_PRIVATE_TEST_HEADERS must never be set in production to prevent potential security vulnerabilities.

Example

if (process.env.NODE_ENV === 'production' && process.env.NEXT_PRIVATE_TEST_HEADERS) {
  console.warn('NEXT_PRIVATE_TEST_HEADERS is set in production, which may expose your application to security risks.');
}

Notes

This fix assumes that the NEXT_PRIVATE_TEST_HEADERS variable is only used for testing purposes and should never be set in a production environment. If this variable is required for other purposes, additional logic may be needed to handle its presence in production.

Recommendation

Apply a workaround by adding a startup warning when NEXT_PRIVATE_TEST_HEADERS is detected in a production environment, as this will help prevent potential security risks without requiring significant code changes.