@akinon/next 2.0.16-rc.0 → 2.0.16-rc.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @akinon/next
 
+## 2.0.16-rc.1
+
+### Patch Changes
+
+- 378607d1: ZERO-4430: Harden CSRF handling for the BFF proxy
+
+  When `settings.csrf.httpOnly` is enabled, the Django `csrftoken` cookie is set `HttpOnly` + `Secure` + `SameSite=Lax` and the token is never exposed to the browser. The Next.js proxy validates the request `Origin` and injects the `x-csrftoken` header server-side from the cookie before forwarding state-changing requests, instead of round-tripping the token through client JavaScript.
+
 ## 2.0.16-rc.0
 
 ### Patch Changes

package/api/auth.ts

@@ -6,7 +6,10 @@ import Settings from 'settings';
 import { urlLocaleMatcherRegex } from '../utils';
 import logger from '@akinon/next/utils/log';
 import { AuthError } from '../types';
-import getRootHostname from '../utils/get-root-hostname';
+import getRootHostname, {
+  getRequestRootHostname
+} from '../utils/get-root-hostname';
+import { getCsrfCookieFlags } from '../utils/csrf';
 import { LocaleUrlStrategy } from '../localization';
 import { cookies, headers } from 'next/headers';
 
@@ -222,12 +225,17 @@ const getDefaultAuthConfig = () => {
           logger.debug(`Login/Register response: ${JSON.stringify(response)}`);
 
           let sessionId = '';
+          let rotatedCsrfToken = '';
           const setCookieHeader = apiRequest.headers.get('set-cookie');
           if (setCookieHeader) {
             sessionId =
               setCookieHeader
                 .match(/osessionid=\w+/)?.[0]
                 .replace(/osessionid=/, '') || '';
+            rotatedCsrfToken =
+              setCookieHeader
+                .match(/csrftoken=[^;,\s]+/)?.[0]
+                .replace(/csrftoken=/, '') || '';
 
             logger.debug(`Login/Register session id: ${sessionId}`);
           } else {
@@ -258,6 +266,14 @@ const getDefaultAuthConfig = () => {
 
             cookieStore.set('osessionid', sessionId, cookieOptions);
             cookieStore.set('sessionid', sessionId, cookieOptions);
+
+            if (rotatedCsrfToken) {
+              cookieStore.set('csrftoken', rotatedCsrfToken, {
+                path: '/',
+                ...getCsrfCookieFlags(),
+                ...(rootHostname ? { domain: rootHostname } : {})
+              });
+            }
           }
 
           if (!response.key) {
@@ -314,14 +330,16 @@ const getDefaultAuthConfig = () => {
       },
       signOut: async () => {
         const cookieStore = await cookies();
-        cookieStore.set('osessionid', '', {
-          path: '/',
-          maxAge: 0
-        });
-        cookieStore.set('sessionid', '', {
+        const rootHostname = getRequestRootHostname(await headers());
+        const expireOptions = {
           path: '/',
-          maxAge: 0
-        });
+          maxAge: 0,
+          ...(rootHostname ? { domain: rootHostname } : {})
+        };
+
+        cookieStore.set('osessionid', '', expireOptions);
+        cookieStore.set('sessionid', '', expireOptions);
+        cookieStore.set('csrftoken', '', expireOptions);
         logger.debug('Successfully signed out');
       }
     },
@@ -575,9 +593,19 @@ const defaultNextAuthOptionsV4 = (req: any, res: any) => {
         logger.debug('Successfully signed in');
       },
       signOut: () => {
+        const rootHostname = getRequestRootHostname({
+          get: (name) => {
+            const v = req.headers[name];
+            return Array.isArray(v) ? v[0] : (v ?? null);
+          }
+        });
+        const domainAttr = rootHostname ? `; Domain=${rootHostname}` : '';
+        const expiry = `Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT${domainAttr}`;
+
         res.setHeader('Set-Cookie', [
-          `osessionid=; Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`,
-          `sessionid=; Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`
+          `osessionid=; ${expiry}`,
+          `sessionid=; ${expiry}`,
+          `csrftoken=; ${expiry}`
         ]);
         logger.debug('Successfully signed out');
       }

package/api/client.ts

@@ -8,6 +8,64 @@ import { cookies } from 'next/headers';
 import getRootHostname from '../utils/get-root-hostname';
 import { LocaleUrlStrategy } from '../localization';
 import { fixtureManager, MockMode } from '../lib/fixture-manager';
+import { user } from '../data/urls';
+import { getCsrfCookieFlags, isCsrfHttpOnly } from '../utils/csrf';
+
+const CSRF_TOKEN_SLUG = user.csrfToken.replace(/^\//, '');
+
+const STATE_CHANGING_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
+
+function getProxyHosts(req: Request): string[] {
+  const hosts = new Set<string>();
+  const forwarded =
+    req.headers.get('x-forwarded-host') || req.headers.get('host');
+  if (forwarded) {
+    hosts.add(forwarded.split(':')[0].toLowerCase());
+  }
+  try {
+    if (process.env.NEXT_PUBLIC_URL) {
+      hosts.add(new URL(process.env.NEXT_PUBLIC_URL).hostname.toLowerCase());
+    }
+  } catch {
+    // ignore malformed NEXT_PUBLIC_URL
+  }
+  return Array.from(hosts);
+}
+
+/**
+ * Next.js-layer CSRF defense for the BFF proxy. State-changing requests must
+ * originate from our own app: when an `Origin` header is present it has to
+ * resolve to the proxy host (or, under the subdomain locale strategy, the
+ * same registrable domain). Requests without an `Origin` (non-browser
+ * clients, same-origin navigations) fall back to the `SameSite=Lax` cookie
+ * guarantee. Only enforced when CSRF hardening is enabled.
+ */
+function isOriginAllowed(req: Request): boolean {
+  const origin = req.headers.get('origin');
+  if (!origin) return true;
+
+  let originHost: string;
+  try {
+    originHost = new URL(origin).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+
+  const allowedHosts = getProxyHosts(req);
+  if (allowedHosts.includes(originHost)) return true;
+
+  if (settings.localization.localeUrlStrategy === LocaleUrlStrategy.Subdomain) {
+    const originRoot = getRootHostname(`https://${originHost}`);
+    return (
+      !!originRoot &&
+      allowedHosts.some(
+        (host) => getRootHostname(`https://${host}`) === originRoot
+      )
+    );
+  }
+
+  return false;
+}
 
 interface RouteParams {
   params: {
@@ -103,6 +161,28 @@ async function proxyRequest(...args) {
     });
   }
 
+  // CSRF hardening (BFF model): when the csrftoken cookie is HttpOnly the
+  // browser can no longer mirror it into the `x-csrftoken` header, so the
+  // proxy validates the request origin and injects the header server-side
+  // from the cookie that the browser sent with this request.
+  if (isCsrfHttpOnly() && STATE_CHANGING_METHODS.includes(req.method)) {
+    if (!isOriginAllowed(req)) {
+      logger.warn('Client Proxy Request - Blocked cross-origin request', {
+        url: req.url,
+        origin: req.headers.get('origin')
+      });
+      return NextResponse.json(
+        { detail: 'CSRF origin check failed.' },
+        { status: 403 }
+      );
+    }
+
+    const csrfToken = nextCookies.get('csrftoken')?.value;
+    if (csrfToken) {
+      fetchOptions.headers['x-csrftoken'] = csrfToken;
+    }
+  }
+
   if (options.contentType) {
     fetchOptions.headers['Content-Type'] = options.contentType;
   }
@@ -240,11 +320,25 @@ async function proxyRequest(...args) {
           if (!cookie.domain && rootHostname) {
             cookie.domain = rootHostname;
           }
+          if (cookie.name === 'csrftoken') {
+            const flags = getCsrfCookieFlags();
+            if (flags.httpOnly) {
+              cookie.httpOnly = true;
+              cookie.secure = flags.secure;
+              cookie.sameSite = flags.sameSite;
+            }
+          }
           return formatCookieString(cookie);
         })
         .join(', ');
     }
 
+    if (slug === CSRF_TOKEN_SLUG) {
+      responseHeaders['Cache-Control'] =
+        'private, no-store, no-cache, must-revalidate';
+      responseHeaders['Pragma'] = 'no-cache';
+    }
+
     return NextResponse.json(
       options.responseType === 'text' ? { result: response } : response,
       { status: request.status, headers: responseHeaders }

package/middlewares/default.ts

@@ -17,8 +17,12 @@ import {
   withMasterpassRestCallback,
   withBfcacheHeaders
 } from '.';
-import { urlLocaleMatcherRegex } from '../utils';
-import { getPzSegmentsConfig, encodePzValue, isLegacyMode } from '../utils/pz-segments';
+import { getCsrfCookieFlags, urlLocaleMatcherRegex } from '../utils';
+import {
+  getPzSegmentsConfig,
+  encodePzValue,
+  isLegacyMode
+} from '../utils/pz-segments';
 import withCurrency from './currency';
 import withLocale from './locale';
 import logger from '../utils/log';
@@ -262,98 +266,98 @@ const withPzDefault =
                                     req: PzNextRequest,
                                     event: NextFetchEvent
                                   ) => {
-                                  let middlewareResult: NextResponse | void =
-                                    NextResponse.next();
-
-                                  try {
-                                    const { locale, prettyUrl, currency } =
-                                      req.middlewareParams.rewrites;
-                                    const { defaultLocaleValue } =
-                                      Settings.localization;
-                                    const url = req.nextUrl.clone();
-                                    const pathnameWithoutLocale =
-                                      url.pathname.replace(
-                                        urlLocaleMatcherRegex,
-                                        ''
-                                      );
+                                    let middlewareResult: NextResponse | void =
+                                      NextResponse.next();
+
+                                    try {
+                                      const { locale, prettyUrl, currency } =
+                                        req.middlewareParams.rewrites;
+                                      const { defaultLocaleValue } =
+                                        Settings.localization;
+                                      const url = req.nextUrl.clone();
+                                      const pathnameWithoutLocale =
+                                        url.pathname.replace(
+                                          urlLocaleMatcherRegex,
+                                          ''
+                                        );
 
-                                    middlewareResult = (await middleware(
-                                      req,
-                                      event
-                                    )) as NextResponse | void;
-
-                                    let customRewriteUrlDiff = '';
-
-                                    if (
-                                      middlewareResult instanceof
-                                        NextResponse &&
-                                      middlewareResult.headers.get(
-                                        'pz-override-response'
-                                      ) &&
-                                      middlewareResult.headers.get(
-                                        'x-middleware-rewrite'
-                                      )
-                                    ) {
-                                      const rewriteUrl = new URL(
+                                      middlewareResult = (await middleware(
+                                        req,
+                                        event
+                                      )) as NextResponse | void;
+
+                                      let customRewriteUrlDiff = '';
+
+                                      if (
+                                        middlewareResult instanceof
+                                          NextResponse &&
+                                        middlewareResult.headers.get(
+                                          'pz-override-response'
+                                        ) &&
                                         middlewareResult.headers.get(
                                           'x-middleware-rewrite'
                                         )
-                                      );
-                                      const originalUrl = new URL(req.url);
-                                      customRewriteUrlDiff =
-                                        rewriteUrl.pathname.replace(
-                                          originalUrl.pathname,
-                                          ''
+                                      ) {
+                                        const rewriteUrl = new URL(
+                                          middlewareResult.headers.get(
+                                            'x-middleware-rewrite'
+                                          )
                                         );
-                                    }
+                                        const originalUrl = new URL(req.url);
+                                        customRewriteUrlDiff =
+                                          rewriteUrl.pathname.replace(
+                                            originalUrl.pathname,
+                                            ''
+                                          );
+                                      }
 
-                                    let ordersPrefix: string;
+                                      let ordersPrefix: string;
 
-                                    if (isLegacyMode(Settings)) {
-                                      url.basePath = `/${commerceUrl}`;
-                                      url.pathname =
-                                        `/${locale.length ? `${locale}/` : ''}${currency}/${customRewriteUrlDiff}${
-                                          prettyUrl ?? pathnameWithoutLocale
-                                        }`.replace(/\/+/g, '/');
-                                      ordersPrefix = `/${currency}/orders`;
-                                    } else {
-                                      const pzConfig =
-                                        getPzSegmentsConfig(Settings);
-                                      const fullUrlPath =
-                                        `${customRewriteUrlDiff}${
+                                      if (isLegacyMode(Settings)) {
+                                        url.basePath = `/${commerceUrl}`;
+                                        url.pathname = `/${
+                                          locale.length ? `${locale}/` : ''
+                                        }${currency}/${customRewriteUrlDiff}${
                                           prettyUrl ?? pathnameWithoutLocale
                                         }`.replace(/\/+/g, '/');
-                                      const fullUrl = `${req.nextUrl.origin}${fullUrlPath}`;
-                                      const resolvedLocale =
-                                        locale?.length > 0
-                                          ? locale
-                                          : Settings.localization
-                                              .defaultLocaleValue;
-                                      const resolveContext = {
-                                        req,
-                                        event,
-                                        url,
-                                        locale: resolvedLocale,
-                                        currency,
-                                        pathname: pathnameWithoutLocale
-                                      };
-                                      const customSegments = pzConfig.segments
-                                        .filter(
-                                          (seg) =>
-                                            seg.name !== 'locale' &&
-                                            seg.name !== 'currency' &&
-                                            seg.name !== 'url'
-                                        );
-                                      const segmentValues: Record<
-                                        string,
-                                        string
-                                      > = {
-                                        locale: resolvedLocale,
-                                        currency,
-                                        url: encodeURIComponent(fullUrl),
-                                        ...Object.fromEntries(
-                                          customSegments
-                                            .map((seg) => [
+                                        ordersPrefix = `/${currency}/orders`;
+                                      } else {
+                                        const pzConfig =
+                                          getPzSegmentsConfig(Settings);
+                                        const fullUrlPath =
+                                          `${customRewriteUrlDiff}${
+                                            prettyUrl ?? pathnameWithoutLocale
+                                          }`.replace(/\/+/g, '/');
+                                        const fullUrl = `${req.nextUrl.origin}${fullUrlPath}`;
+                                        const resolvedLocale =
+                                          locale?.length > 0
+                                            ? locale
+                                            : Settings.localization
+                                                .defaultLocaleValue;
+                                        const resolveContext = {
+                                          req,
+                                          event,
+                                          url,
+                                          locale: resolvedLocale,
+                                          currency,
+                                          pathname: pathnameWithoutLocale
+                                        };
+                                        const customSegments =
+                                          pzConfig.segments.filter(
+                                            (seg) =>
+                                              seg.name !== 'locale' &&
+                                              seg.name !== 'currency' &&
+                                              seg.name !== 'url'
+                                          );
+                                        const segmentValues: Record<
+                                          string,
+                                          string
+                                        > = {
+                                          locale: resolvedLocale,
+                                          currency,
+                                          url: encodeURIComponent(fullUrl),
+                                          ...Object.fromEntries(
+                                            customSegments.map((seg) => [
                                               seg.name,
                                               req.middlewareParams.rewrites[
                                                 seg.name
@@ -362,105 +366,121 @@ const withPzDefault =
                                                   ? seg.resolve(resolveContext)
                                                   : '')
                                             ])
-                                        )
-                                      };
-
-                                      const pzValue = encodePzValue(
-                                        segmentValues,
-                                        pzConfig
-                                      );
+                                          )
+                                        };
 
-                                      url.pathname =
-                                        `/${pzValue}/${fullUrlPath}`.replace(
-                                          /\/+/g,
-                                          '/'
+                                        const pzValue = encodePzValue(
+                                          segmentValues,
+                                          pzConfig
                                         );
-                                      ordersPrefix = `/${pzValue}/orders`;
-                                    }
 
-                                    if (
-                                      Settings.usePrettyUrlRoute &&
-                                      url.searchParams.toString().length > 0 &&
-                                      !Object.entries(ROUTES).find(
-                                        ([, value]) =>
-                                          new RegExp(`^${value}/?$`).test(
-                                            pathnameWithoutLocale
-                                          )
-                                      )
-                                    ) {
-                                      url.pathname =
-                                        url.pathname +
-                                        (/\/$/.test(url.pathname) ? '' : '/') +
-                                        `searchparams|${encodeURIComponent(
-                                          url.searchParams.toString()
-                                        )}`;
-                                    }
-
-                                    Settings.rewrites.forEach((rewrite) => {
-                                      url.pathname = url.pathname.replace(
-                                        rewrite.source,
-                                        rewrite.destination
-                                      );
-                                    });
+                                        url.pathname =
+                                          `/${pzValue}/${fullUrlPath}`.replace(
+                                            /\/+/g,
+                                            '/'
+                                          );
+                                        ordersPrefix = `/${pzValue}/orders`;
+                                      }
 
-                                    // if middleware.ts has a return value for current url
-                                    if (
-                                      middlewareResult instanceof NextResponse
-                                    ) {
-                                      // pz-override-response header is used to prevent 404 page for custom responses.
                                       if (
-                                        middlewareResult.headers.get(
-                                          'pz-override-response'
-                                        ) !== 'true'
+                                        Settings.usePrettyUrlRoute &&
+                                        url.searchParams.toString().length >
+                                          0 &&
+                                        !Object.entries(ROUTES).find(
+                                          ([, value]) =>
+                                            new RegExp(`^${value}/?$`).test(
+                                              pathnameWithoutLocale
+                                            )
+                                        )
                                       ) {
-                                        middlewareResult.headers.set(
-                                          'x-middleware-rewrite',
-                                          url.href
+                                        url.pathname =
+                                          url.pathname +
+                                          (/\/$/.test(url.pathname)
+                                            ? ''
+                                            : '/') +
+                                          `searchparams|${encodeURIComponent(
+                                            url.searchParams.toString()
+                                          )}`;
+                                      }
+
+                                      Settings.rewrites.forEach((rewrite) => {
+                                        url.pathname = url.pathname.replace(
+                                          rewrite.source,
+                                          rewrite.destination
                                         );
-                                      } else if (
-                                        middlewareResult.headers.get(
-                                          'x-middleware-rewrite'
-                                        ) &&
-                                        middlewareResult.headers.get(
-                                          'pz-override-response'
-                                        ) === 'true'
+                                      });
+
+                                      // if middleware.ts has a return value for current url
+                                      if (
+                                        middlewareResult instanceof NextResponse
                                       ) {
+                                        // pz-override-response header is used to prevent 404 page for custom responses.
+                                        if (
+                                          middlewareResult.headers.get(
+                                            'pz-override-response'
+                                          ) !== 'true'
+                                        ) {
+                                          middlewareResult.headers.set(
+                                            'x-middleware-rewrite',
+                                            url.href
+                                          );
+                                        } else if (
+                                          middlewareResult.headers.get(
+                                            'x-middleware-rewrite'
+                                          ) &&
+                                          middlewareResult.headers.get(
+                                            'pz-override-response'
+                                          ) === 'true'
+                                        ) {
+                                          middlewareResult =
+                                            NextResponse.rewrite(url);
+                                        }
+                                      } else {
+                                        // if middleware.ts doesn't have a return value.
+                                        // e.g. NextResponse.next() doesn't exist in middleware.ts
+
                                         middlewareResult =
                                           NextResponse.rewrite(url);
                                       }
-                                    } else {
-                                      // if middleware.ts doesn't have a return value.
-                                      // e.g. NextResponse.next() doesn't exist in middleware.ts
 
-                                      middlewareResult =
-                                        NextResponse.rewrite(url);
-                                    }
+                                      const { localeUrlStrategy } =
+                                        Settings.localization;
+
+                                      const fallbackHost =
+                                        req.headers.get('x-forwarded-host') ||
+                                        req.headers.get('host');
+                                      const hostname =
+                                        process.env.NEXT_PUBLIC_URL ||
+                                        `https://${fallbackHost}`;
+                                      const rootHostname =
+                                        localeUrlStrategy ===
+                                        LocaleUrlStrategy.Subdomain
+                                          ? getRootHostname(hostname)
+                                          : null;
+
+                                      if (
+                                        !url.pathname.startsWith(ordersPrefix)
+                                      ) {
+                                        middlewareResult.cookies.set(
+                                          'pz-locale',
+                                          locale?.length > 0
+                                            ? locale
+                                            : defaultLocaleValue,
+                                          {
+                                            domain: rootHostname,
+                                            sameSite: 'none',
+                                            secure: true,
+                                            expires: new Date(
+                                              Date.now() +
+                                                1000 * 60 * 60 * 24 * 7
+                                            ) // 7 days
+                                          }
+                                        );
+                                      }
 
-                                    const { localeUrlStrategy } =
-                                      Settings.localization;
-
-                                    const fallbackHost =
-                                      req.headers.get('x-forwarded-host') ||
-                                      req.headers.get('host');
-                                    const hostname =
-                                      process.env.NEXT_PUBLIC_URL ||
-                                      `https://${fallbackHost}`;
-                                    const rootHostname =
-                                      localeUrlStrategy ===
-                                      LocaleUrlStrategy.Subdomain
-                                        ? getRootHostname(hostname)
-                                        : null;
-
-                                    if (
-                                      !url.pathname.startsWith(
-                                        ordersPrefix
-                                      )
-                                    ) {
                                       middlewareResult.cookies.set(
-                                        'pz-locale',
-                                        locale?.length > 0
-                                          ? locale
-                                          : defaultLocaleValue,
+                                        'pz-currency',
+                                        currency,
                                         {
                                           domain: rootHostname,
                                           sameSite: 'none',
@@ -470,103 +490,89 @@ const withPzDefault =
                                           ) // 7 days
                                         }
                                       );
-                                    }
 
-                                    middlewareResult.cookies.set(
-                                      'pz-currency',
-                                      currency,
-                                      {
-                                        domain: rootHostname,
-                                        sameSite: 'none',
-                                        secure: true,
-                                        expires: new Date(
-                                          Date.now() + 1000 * 60 * 60 * 24 * 7
-                                        ) // 7 days
+                                      if (
+                                        req.cookies.get('pz-locale') &&
+                                        req.cookies.get('pz-locale').value !==
+                                          locale
+                                      ) {
+                                        logger.debug('Locale changed', {
+                                          locale,
+                                          oldLocale:
+                                            req.cookies.get('pz-locale')?.value,
+                                          ip
+                                        });
                                       }
-                                    );
-
-                                    if (
-                                      req.cookies.get('pz-locale') &&
-                                      req.cookies.get('pz-locale').value !==
-                                        locale
-                                    ) {
-                                      logger.debug('Locale changed', {
-                                        locale,
-                                        oldLocale:
-                                          req.cookies.get('pz-locale')?.value,
-                                        ip
-                                      });
-                                    }
-
-                                    middlewareResult.headers.set(
-                                      'pz-url',
-                                      req.nextUrl.toString()
-                                    );
 
-                                    if (req.cookies.get('pz-set-currency')) {
-                                      middlewareResult.cookies.delete(
-                                        'pz-set-currency'
+                                      middlewareResult.headers.set(
+                                        'pz-url',
+                                        req.nextUrl.toString()
                                       );
-                                    }
 
-                                    if (
-                                      req.cookies.get(
-                                        'pz-post-checkout-flow'
-                                      )
-                                    ) {
-                                      if (
-                                        pathnameWithoutLocale.startsWith(
-                                          '/orders/completed/'
-                                        ) ||
-                                        pathnameWithoutLocale.startsWith(
-                                          '/basket'
-                                        )
-                                      ) {
+                                      if (req.cookies.get('pz-set-currency')) {
                                         middlewareResult.cookies.delete(
-                                          'pz-post-checkout-flow'
+                                          'pz-set-currency'
                                         );
                                       }
-                                    }
-
-                                    if (process.env.ACC_APP_VERSION) {
-                                      middlewareResult.headers.set(
-                                        'acc-app-version',
-                                        process.env.ACC_APP_VERSION
-                                      );
-                                    }
 
-                                    // Set CSRF token if not set
-                                    try {
-                                      const url = `${Settings.commerceUrl}${user.csrfToken}`;
+                                      if (
+                                        req.cookies.get('pz-post-checkout-flow')
+                                      ) {
+                                        if (
+                                          pathnameWithoutLocale.startsWith(
+                                            '/orders/completed/'
+                                          ) ||
+                                          pathnameWithoutLocale.startsWith(
+                                            '/basket'
+                                          )
+                                        ) {
+                                          middlewareResult.cookies.delete(
+                                            'pz-post-checkout-flow'
+                                          );
+                                        }
+                                      }
 
-                                      if (!req.cookies.get('csrftoken')) {
-                                        const { csrf_token } = await (
-                                          await fetch(url)
-                                        ).json();
-                                        middlewareResult.cookies.set(
-                                          'csrftoken',
-                                          csrf_token,
-                                          {
-                                            domain: rootHostname,
-                                            secure: true
-                                          }
+                                      if (process.env.ACC_APP_VERSION) {
+                                        middlewareResult.headers.set(
+                                          'acc-app-version',
+                                          process.env.ACC_APP_VERSION
                                         );
                                       }
+
+                                      // Set CSRF token if not set
+                                      try {
+                                        const url = `${Settings.commerceUrl}${user.csrfToken}`;
+
+                                        if (!req.cookies.get('csrftoken')) {
+                                          const { csrf_token } = await (
+                                            await fetch(url)
+                                          ).json();
+                                          middlewareResult.cookies.set(
+                                            'csrftoken',
+                                            csrf_token,
+                                            {
+                                              path: '/',
+                                              domain: rootHostname,
+                                              ...getCsrfCookieFlags()
+                                            }
+                                          );
+                                        }
+                                      } catch (error) {
+                                        logger.error('CSRF Error', {
+                                          error,
+                                          ip
+                                        });
+                                      }
                                     } catch (error) {
-                                      logger.error('CSRF Error', {
+                                      logger.error('withPzDefault Error', {
                                         error,
                                         ip
                                       });
                                     }
-                                  } catch (error) {
-                                    logger.error('withPzDefault Error', {
-                                      error,
-                                      ip
-                                    });
-                                  }
 
-                                  return middlewareResult;
-                                })
+                                    return middlewareResult;
+                                  }
+                                )
                               )
                             )
                           )

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@akinon/next",
   "description": "Core package for Project Zero Next",
-  "version": "2.0.16-rc.0",
+  "version": "2.0.16-rc.1",
   "private": false,
   "license": "MIT",
   "bin": {
@@ -36,7 +36,7 @@
     "set-cookie-parser": "2.6.0"
   },
   "devDependencies": {
-    "@akinon/eslint-plugin-projectzero": "2.0.16-rc.0",
+    "@akinon/eslint-plugin-projectzero": "2.0.16-rc.1",
     "@babel/core": "7.26.10",
     "@babel/preset-env": "7.26.9",
     "@babel/preset-typescript": "7.27.0",

package/types/index.ts

@@ -91,6 +91,25 @@ export interface Settings {
    * It overrides process.env.NEXT_PUBLIC_SENTRY_DSN and process.env.SENTRY_DSN.
    */
   sentryDsn?: string;
+  /**
+   * CSRF cookie hardening settings.
+   *
+   * When `httpOnly` is `true`, the `csrftoken` cookie is set with the
+   * `HttpOnly`, `Secure` (production) and `SameSite=Lax` flags. The token is
+   * never exposed to the browser: instead of the client mirroring the cookie
+   * into the `x-csrftoken` header, the Next.js proxy (BFF) reads the cookie
+   * server-side and injects the header before forwarding state-changing
+   * requests to the commerce backend, after validating the request `Origin`.
+   *
+   * Because the token no longer reaches JS, brand code must NOT rely on
+   * reading `csrftoken` from `document.cookie` or `getCookie('csrftoken')`
+   * when this flag is enabled — all CSRF handling happens on the server.
+   *
+   * @default false
+   */
+  csrf?: {
+    httpOnly?: boolean;
+  };
   redis: {
     defaultExpirationTime: number;
   };
@@ -283,7 +302,9 @@ export interface PzSegmentsConfig {
 }
 
 // Search params type compatible with both Next.js resolved searchParams and URLSearchParams
-export type SearchParams = Record<string, string | string[] | undefined> | URLSearchParams;
+export type SearchParams =
+  | Record<string, string | string[] | undefined>
+  | URLSearchParams;
 
 // Raw Next 16 server prop shape, used at the middleware/HOC boundary before normalization
 export type RawSearchParams = Record<string, string | string[] | undefined>;
@@ -316,14 +337,16 @@ export interface RootLayoutProps<T = any> extends LayoutProps<T> {
 
 // Async versions for Next.js 16 generateMetadata and internal use
 export interface AsyncPageProps<T = any> {
-  params: Promise<T & {
-    pz?: string;
-    commerce?: string;
-    locale?: string;
-    currency?: string;
-    url?: string;
-    [key: string]: any;
-  }>;
+  params: Promise<
+    T & {
+      pz?: string;
+      commerce?: string;
+      locale?: string;
+      currency?: string;
+      url?: string;
+      [key: string]: any;
+    }
+  >;
   searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 }
 

package/utils/csrf.ts

@@ -0,0 +1,37 @@
+import settings from 'settings';
+
+/**
+ * Whether the Django `csrftoken` cookie should be hardened with the
+ * `HttpOnly` flag.
+ *
+ * When enabled, the token never reaches the browser: the Next.js proxy
+ * (BFF) reads the cookie server-side and injects the `x-csrftoken` header
+ * before forwarding state-changing requests to the commerce backend. See
+ * `api/client.ts`.
+ */
+export function isCsrfHttpOnly(): boolean {
+  return settings.csrf?.httpOnly === true;
+}
+
+export interface CsrfCookieFlags {
+  httpOnly: boolean;
+  secure: boolean;
+  sameSite: 'lax';
+}
+
+/**
+ * Cookie attributes applied to the `csrftoken` cookie wherever it is set
+ * (middleware bootstrap, auth login rotation, proxy passthrough).
+ *
+ * `SameSite=Lax` is the Next.js-layer CSRF defense: the browser will not
+ * attach the cookie on cross-site state-changing requests, so the proxy's
+ * server-side header injection cannot be abused from a third-party origin.
+ */
+export function getCsrfCookieFlags(): CsrfCookieFlags {
+  const httpOnly = isCsrfHttpOnly();
+  return {
+    httpOnly,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax'
+  };
+}

package/utils/get-root-hostname.ts

@@ -1,4 +1,5 @@
 import Settings from 'settings';
+import { LocaleUrlStrategy } from '../localization';
 
 export default function getRootHostname(
   url: string | undefined
@@ -26,3 +27,20 @@ export default function getRootHostname(
     return null;
   }
 }
+
+interface HeaderLike {
+  get(name: string): string | null;
+}
+
+export function getRequestRootHostname(
+  headerStore: HeaderLike
+): string | null {
+  if (Settings.localization.localeUrlStrategy !== LocaleUrlStrategy.Subdomain) {
+    return null;
+  }
+
+  const fallbackHost =
+    headerStore.get('x-forwarded-host') || headerStore.get('host');
+  const hostname = process.env.NEXT_PUBLIC_URL || `https://${fallbackHost}`;
+  return getRootHostname(hostname);
+}

package/utils/index.ts

@@ -10,6 +10,7 @@ export * from './get-currency-label';
 export * from './pz-segments';
 export * from './get-checkout-path';
 export * from './format-error-message';
+export * from './csrf';
 
 export function getCookie(name: string) {
   if (typeof document === 'undefined') {