[BUG Follow-up] Extend clickjacking protections to all auth pages

[benjaminfh]

Motivation

• The login page had frame protection added previously but the protection needed to be extended to all auth-related public routes to prevent iframe-based clickjacking across the auth surface.
• The change centralizes header injection so anti-framing headers are applied consistently regardless of response type for matching auth routes.

Description

• Added shouldApplyClickjackingProtection and withClickjackingHeaders helpers to middleware.ts to centralize the anti-framing logic and decisioning for protected paths.
• The middleware now sets X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' for matching routes (/login, /check-email, /forgot-password, /reset-password, and /auth/*).
• Headers are applied across response types (normal NextResponse.next(), redirect responses, maintenance responses, and the incomplete-env 500 response) by wrapping returned responses with withClickjackingHeaders when the request pathname matches.
• Updated tests/server/middleware.test.ts to assert the new anti-framing headers on the authenticated /login redirect and on other auth pages like /forgot-password and /check-email.

Testing

• Ran the targeted test file with npm test -- tests/server/middleware.test.ts using vitest, and all tests passed (4 tests, 1 file).
• The updated tests specifically verify the x-frame-options and content-security-policy headers on protected auth pages and on the login redirect, and they succeeded.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threds	Ready	Preview, Comment	Feb 25, 2026 3:28pm

[supabase]

Updates to [Preview Branch (codex/2026-02-25/github-mention-bug]-fix-clickjacking-vurnerability) ↗︎](https://supabase.com/dashboard/project/mersykfigxgsnbbmjbvl)

Deployments	Status	Updated
Database	✅	Wed, 25 Feb 2026 15:27:39 UTC
Services	✅	Wed, 25 Feb 2026 15:27:39 UTC
APIs	✅	Wed, 25 Feb 2026 15:27:39 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Wed, 25 Feb 2026 15:27:49 UTC
Migrations	✅	Wed, 25 Feb 2026 15:27:50 UTC
Seeding	✅	Wed, 25 Feb 2026 15:27:53 UTC
Edge Functions	✅	Wed, 25 Feb 2026 15:27:53 UTC

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.