Migrating to Next.js App Router without opening security holes
Security checklist when migrating from Pages Router: auth, CSRF, env vars, and middleware.
Teams in Puerto Rico migrate Next.js sites from Pages Router to App Router for performance and DX — but copy insecure patterns: secrets in client components, server actions without validation, bypassable middleware auth. OWASP ASVS and official Next.js guides emphasize server-side validation; migration is the moment to fix debt, not amplify it.
Pre-migration checklist: inventory API routes and getServerSideProps handling auth; map server-only env vars vs NEXT_PUBLIC_; audit cookies and session handling. Server Actions require native CSRF protection in Next.js 14+ — verify you did not disable origin check "temporarily" in staging.
Middleware: protect /admin and /api routes with explicit matcher; do not rely on path obscurity. Bruce Schneier discourages security by obscurity — bots find unauthenticated /dashboard in minutes. Rate limit in middleware for login and password reset using Upstash or similar.
Auth providers (NextAuth, Clerk, Auth.js): revalidate configuration post-migration — callback URLs, secret rotation, session strategy. Smashing Magazine published App Router migration guides; complement with CSP header review after script loading changes.
Deployment: staging on subdomain with synthetic data, light pentest on authenticated routes, documented rollback plan. Mainland clients with sites for Puerto Rico market do not forgive migration downtime — security and stability go together on App Router cutover.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
