Next.js · Middle · Question 54 of 75
Where can you add security headers like X-Frame-Options to all responses without touching pages?
async headers() {
return [{ source: '/(.*)', headers: [{ key: 'X-Frame-Options', value: 'DENY' }] }]
}- ✓Correct answer: In
headers()innext.config.ts(or inproxy.tsfor dynamic values) - 2Only via a
<meta>tag in the root layout - 3In
metadata.headers
Explanation
Config headers apply by path pattern. Headers that depend on the request, like a CSP nonce, are set in proxy.ts.