[Sarika-Kafle]

…ance security headers in next.config

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates HTTP header configuration to centralize security headers in Next.js and adjust caching behavior, while removing Nginx static-asset caching rules.

Changes:

• Centralized security headers in next.config.mjs and added a default Cache-Control: no-store header for most routes.
• Scoped Next.js headers to exclude /_next/static and /_next/image.
• Removed Nginx location blocks that set long-lived caching headers for static assets.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
next.config.mjs	Adds shared security headers + applies no-store caching to most routes; changes header scope pattern.
deploy/nginx/nginx.conf.template	Removes static asset caching location block.
deploy/nginx/nginx.conf	Removes static asset caching location block (and its comment).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Code Review

This pull request removes static file caching from the Nginx configuration and refactors security and dynamic headers in next.config.mjs. Key feedback includes restoring the production-conditional HSTS (Strict-Transport-Security) header that was removed, updating the route matching pattern in next.config.mjs to prevent disabling cache for public static assets, and ensuring that security headers are not duplicated between Next.js and Nginx configurations.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Defining these security headers in next.config.mjs while they are also defined via add_header directives in deploy/nginx/nginx.conf (and deploy/nginx/nginx.conf.template) will result in duplicate headers being sent in the HTTP response. Duplicate headers (like X-Frame-Options or Referrer-Policy) can cause browsers to ignore the policies or behave unexpectedly. To resolve this, please remove the duplicate add_header directives from your Nginx configuration files so that Next.js remains the single source of truth for these headers.

[gemini-code-assist]

The HSTS (Strict-Transport-Security) header logic that was previously applied only in production has been completely removed. If this application is deployed directly or in environments where Nginx is not sitting in front of it (e.g., direct PaaS or serverless deployments), it will lack HSTS protection. It is highly recommended to restore the production-conditional HSTS header in next.config.mjs.

    const headers = [
      ...dynamicHeaders,
      { key: 'Content-Security-Policy', value: csp }
    ];

    if (process.env.NODE_ENV === 'production') {
      headers.push({ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' });
    }

    return [
      {
        source: '/((?!_next/static|_next/image).*)',
        headers
      }
    ];

[gemini-code-assist]

The negative lookahead pattern /((?!_next/static|_next/image).*) matches all routes except _next/static and _next/image. This means that any static assets served from the public directory (such as /favicon.ico, /robots.txt, or other custom images/fonts) will match this route and receive the Cache-Control: no-store, max-age=0, must-revalidate header. This disables caching for all public assets, causing a performance regression. Consider updating the pattern to also exclude common static file extensions or specific public files.

Suggested change

	source: '/((?!_next/static|_next/image).*)',
	source: '/((?!_next/static|_next/image|favicon.ico|robots.txt|.*\\.(?:svg|png|jpg|jpeg|gif|ico|webp|woff2?)).*)',