Next.js15のセキュリティアーキテクチャ: CSRF、SSRF、ステートインジェクションからServer Actionsを強化する

// middleware.ts
import { NextResponse, type NextRequest } from 'next/server';

const ALLOWED_HOSTS = process.env.NEXT_PUBLIC_ALLOWED_HOSTS
  ? process.env.NEXT_PUBLIC_ALLOWED_HOSTS.split(',')
  : ['locionic.com', 'www.locionic.com']; // Replace with your actual domains

export async function middleware(request: NextRequest) {
  const host = request.headers.get('host');
  const origin = request.headers.get('origin');
  const xInvokeAction = request.headers.get('x-invoke-action'); // Specific to Server Actions

  // 1. Host Header Validation
  if (host && !ALLOWED_HOSTS.includes(host)) {
    console.warn(`CSRF: Blocked request due to untrusted Host: ${host}`);
    return new NextResponse('Unauthorized Host', { status: 403 });
  }

  // 2. Origin Header Validation for Server Actions
  // Server Actions typically send an 'Origin' header, especially cross-origin.
  // For same-origin requests, 'Origin' might be null or same as 'Host'.
  // We specifically check 'x-invoke-action' to target Server Action requests.
  if (xInvokeAction) {
    if (origin && !ALLOWED_HOSTS.some(allowedHost => origin.endsWith(allowedHost))) {
      console.warn(`CSRF: Blocked Server Action due to untrusted Origin: ${origin}`);
      return new NextResponse('Unauthorized Origin for Server Action', { status: 403 });
    }
    // If origin is null/undefined for a Server Action, it's likely a same-origin form submission
    // or a non-browser client. Further checks might be needed for non-browser clients.
  }

  return NextResponse.next();
}

export const config = {
  matcher: [
    /*
     * Match all request paths except for the ones starting with:
     * - _next/static (static files)
     * - _next/image (image optimization files)
     * - favicon.ico (favicon file)
     * - api/auth (auth routes, if handled separately)
     * - Any public files in /public folder
     */
    '/((?!_next/static|_next/image|favicon.ico|api/auth|.*\\.(?:png|jpg|jpeg|gif|webp|svg|ico|js|css|map)$).*)',
  ],
};