1. Hop 1Forge a customer session via RS256→HS256 algorithm confusion
   jwt: the public verification key doubles as the HMAC secret — a forged token (sub=219) was accepted at GET /api/orders/me → 200; the anonymous control was rejected 401
2. Hop 2Replay the forged identity against the order API
   idor: GET /api/orders/1042 with the forged token → 200 — the record is owned by user 219, returned to a session that never authenticated as them
3. Hop 3Read the victim's order history
   order 1042 payload carried the customer name, delivery address, and itemized receipt of user 219 — a cross-tenant data read demonstrated end-to-end

GET /search?q=gift' UNION SELECT NULL,version()-- -

curl -H 'Accept: text/html' 'https://acme-store.example.com/search?q=gift%27%20UNION%20SELECT%20NULL%2Cversion%28%29--%20-'

const rows = await db.query(`SELECT * FROM products WHERE name ILIKE '%${q}%'`);

const rows = await db.query('SELECT * FROM products WHERE name ILIKE $1', [`%${q}%`]);

• https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
• https://cwe.mitre.org/data/definitions/89.html

• https://cwe.mitre.org/data/definitions/347.html
• https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html

curl -H 'Accept: application/json' 'https://acme-store.example.com/api/orders/1042'

• https://owasp.org/www-project-api-security/ — API1:2023 Broken Object Level Authorization
• https://cwe.mitre.org/data/definitions/639.html

curl -H 'Accept: text/html' 'https://acme-store.example.com/search?q=ts9f3k2%22%3E%3Csvg%20id%3Dts9f3k2%3E'

• https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

// next.config.ts
const securityHeaders = [
  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
  { key: "Content-Security-Policy", value: "default-src 'self'; object-src 'none'; frame-ancestors 'none'" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
];

export default {
  async headers() {
    return [{ source: "/:path*", headers: securityHeaders }];
  },
};

// next.config.ts
const securityHeaders = [
  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
  { key: "Content-Security-Policy", value: "default-src 'self'; object-src 'none'; frame-ancestors 'none'" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
];

export default {
  async headers() {
    return [{ source: "/:path*", headers: securityHeaders }];
  },
};