feat: mise à jour sécurité CVE-2025-55182 (Next.js 15.5.7, React 19.1.2)

middleware.ts

@@ -0,0 +1,23 @@
+import { auth } from "@/auth";
+import { NextResponse } from "next/server";
+
+export default auth((req) => {
+  const { pathname } = req.nextUrl;
+
+  if (pathname.startsWith("/dashboard") && !req.auth) {
+    return Response.redirect(
+      new URL("/api/auth/signin?callbackUrl=/dashboard", req.url)
+    );
+  }
+
+  const res = NextResponse.next();
+
+  res.headers.set("X-Frame-Options", "DENY");
+  res.headers.set("Content-Security-Policy", "frame-ancestors 'none';");
+
+  return res;
+});
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};