---
title: "Discussion on \"Next.js Security Hardening: Middleware, Server Actions, and CSP Patterns That Hold Up\" | Hashnode"
description: "Discussion on \"Next.js Security Hardening: Middleware, Server Actions, and CSP Patterns That Hold Up\". If you searched nextjs security after skimming an advisory and wondering whether your own app is exposed, this guide gives you the four places that actually break and the code that closes them. You wi"
url: "https://hashnode.com/posts/next-js-security-hardening-middleware-server-actions-and-csp-patterns-that-hold-up/6a7b83c2db309b802910f546"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Next.js Security Hardening: Middleware, Server Actions, and CSP Patterns That Hold Up](https://mudassirworks.hashnode.dev/next-js-security-hardening-middleware-server-actions-and-csp-patterns-that-hold-up?utm_source=hashnode&utm_medium=feed)

If you searched nextjs security after skimming an advisory and wondering whether your own app is exposed, this guide gives you the four places that actually break and the code that closes them. You wi

Aug 11 · 13 min read · mudassirworks.hashnode.dev  
Read the article

-   [#nextjs](https://hashnode.com/tag/nextjs)
-   [#security](https://hashnode.com/tag/security)
-   [#webdev](https://hashnode.com/tag/webdev)
-   [#javascript](https://hashnode.com/tag/javascript)
-   [#typescript](https://hashnode.com/tag/typescript)
-   [#webdevelopment](https://hashnode.com/tag/webdevelopment)
-   [#javascript-framework](https://hashnode.com/tag/javascript-framework)
-   [#type-script](https://hashnode.com/tag/type-script)

## Written by

[Mudassir Khan](https://hashnode.com/@muddi00seven)

@muddi00seven

  
[View profile](https://hashnode.com/@muddi00seven)

## Responses 1

Markdown supported · ⌘↵ to post

[Andrew](https://hashnode.com/@rizzdev)

[Aug 12](https://hashnode.com/posts/next-js-security-hardening-middleware-server-actions-and-csp-patterns-that-hold-up/6a7b83c2db309b802910f546/comment/6a7c17fc1463db7b22f1a802)

I like how this puts the check next to the data rather than the route. Server actions stay public until proven otherwise.