Next.js Content Security Policy: Nonces, Middleware, and Strict CSP (2026)
Learn how to add a strict Content Security Policy to your Next.js App Router app: per-request nonces in middleware, strict-dynamic, style-src pitfalls, and report-only rollout.