Security
How to secure session cookies for Strapi and Next.js
Learn step‑by‑step how to configure HttpOnly, Secure and SameSite cookies, rotate refresh tokens, and protect against CSRF in a Strapi 5 and Next.js stack.
· 4 min read
Security articles
Defensive security for web apps and headless CMS: authentication, APIs, secrets, security headers, dependencies and GDPR.
Security
Configure security headers and CSP for Strapi + Next.js – defensive guide
Learn step‑by‑step how to add essential security headers and a strict Content‑Security‑Policy to a Strapi headless CMS and Next.js frontend, protecting against XSS, clickjacking and data‑leak risks.
· 4 min read
Security
Preventing SSRF in Strapi 5: Configuration and Defensive Coding Guide
Learn how to stop Server‑Side Request Forgery in Strapi 5 by using proxy settings, URL whitelisting, security headers, rate limiting, and audit‑log monitoring.
· 3 min read
Security
Secure backups and audit logs in Strapi 5 for GDPR‑compliant applications
Learn step‑by‑step how to configure encrypted backups, enable audit logging, manage secrets, and meet GDPR requirements in a Strapi 5 project.
· 4 min read
Security
Secure rotation & revocation of Strapi API and admin tokens
Learn how to configure, automate, and audit token rotation and revocation in Strapi 5, keep keys visible for operations, satisfy GDPR requirements, and stay protected against token leakage.
· 4 min read
Security
Secure a Strapi headless CMS: OWASP Top 10 checklist and hardening guide
A step‑by‑step defensive guide that maps the OWASP Top 10 to Strapi, covering auth, API security, secrets, dependencies, headers, backups, audit logs and GDPR compliance.
· 5 min read