middleware.ts has no tests: CSP header generation and nonce handling are uncovered
Labels / Complexity: testing · Medium Complexity — Medium
Problem
src/middleware.ts applies the nonce-based CSP policy to every response — the security header layer of the whole app. It has no tests. A regression that drops the CSP header, reuses nonces, or breaks the dev-vs-prod directive split ships silently and removes the app's script-injection defense without CI noticing.
Why this is architecturally hard
- Header output is the test design. Tests must assert the generated
Content-Security-Policy header for dev and prod modes and that nonces are unique per request.
- Middleware runs per-request. Testing requires invoking the middleware with mock
NextRequest/NextResponse objects (the pattern used for other route-level tests).
Acceptance criteria
- Tests cover header generation (dev/prod), nonce uniqueness, and the API-path skip behavior.
- Tests run in CI via
npm test.
Out of scope
CSP policy content changes; other middleware.
Getting started
src/middleware.ts — the CSP generationsrc/app/api/csp-report/route.ts — the reporting sink the policy references
Commands: npm test.
Good first files to read: src/middleware.ts.
middleware.ts has no tests: CSP header generation and nonce handling are uncovered
Labels / Complexity: testing · Medium Complexity — Medium
Problem
src/middleware.tsapplies the nonce-based CSP policy to every response — the security header layer of the whole app. It has no tests. A regression that drops the CSP header, reuses nonces, or breaks the dev-vs-prod directive split ships silently and removes the app's script-injection defense without CI noticing.Why this is architecturally hard
Content-Security-Policyheader for dev and prod modes and that nonces are unique per request.NextRequest/NextResponseobjects (the pattern used for other route-level tests).Acceptance criteria
npm test.Out of scope
CSP policy content changes; other middleware.
Getting started
src/middleware.ts— the CSP generationsrc/app/api/csp-report/route.ts— the reporting sink the policy referencesCommands:
npm test.Good first files to read:
src/middleware.ts.