PensionsPortal.ie applies a set of HTTP security headers to every response. These headers are configured in next.config.ts and applied globally via Next.js’s headers() async function.
All headers are applied to all routes (source: "/(.*)") in next.config.ts:
Strict-Transport-Security (HSTS)
- max-age=63072000 — 2 years (720 days). Browsers will only connect via HTTPS for this duration.
- includeSubDomains — policy applies to all subdomains
- preload — domain is eligible for submission to HSTS preload lists embedded in browsers
Content Security Policy (CSP)
unsafe-eval is currently required by the Next.js development runtime. Consider implementing nonce-based CSP in a future iteration to allow removal of unsafe-eval in production.
X-Frame-Options
Prevents the application from being embedded in iframes on external domains, protecting against clickjacking. Note: the CSP frame-ancestors 'none' directive is stricter and takes precedence in modern browsers.
X-Content-Type-Options
Prevents browsers from MIME-type sniffing, which can cause JavaScript execution from non-script resources.
Referrer-Policy
Sends the full referrer for same-origin requests; sends only the origin (no path) for cross-origin HTTPS requests; sends nothing for HTTP requests. Prevents leaking URL paths containing IDs to third-party services.
Permissions-Policy
Explicitly disables camera, microphone, and geolocation access. The application does not use these browser APIs.
X-DNS-Prefetch-Control
Allows DNS prefetching for performance. This is a low-risk setting; DNS prefetch does not expose request contents.
The X-Powered-By: Next.js header is explicitly removed to avoid disclosing the framework version to potential attackers. 
