# Security Headers Investigation

## Problem
Security headers (CSP, HSTS, Referrer-Policy, Permissions-Policy) are configured in both `next.config.ts` and `middleware.ts` but are not appearing in HTTP responses.

## What Works
- Basic headers from `next.config.ts` (X-DNS-Prefetch-Control, X-Frame-Options, X-Content-Type-Options) ARE appearing
- Middleware IS running (evident from `x-middleware-rewrite` header)

## What Doesn't Work
- New security headers from `next.config.ts` (CSP, HSTS, Referrer-Policy, Permissions-Policy) NOT appearing
- Headers set in middleware.ts NOT appearing

## Root Cause
Next.js middleware rewrites combined with prerendered pages prevents headers from being applied properly. The response shows:
- `x-nextjs-prerender: 1`
- `x-nextjs-cache: HIT`

This indicates static/prerendered content where middleware headers don't propagate.

## Attempted Solutions
1. ✗ Setting headers in middleware after intl middleware
2. ✗ Cloning response and adding headers
3. ✗ Using NextResponse.next() with headers option
4. ✗ Using async middleware

## Next Steps
Need to check:
1. If `next-intl` middleware provides a callback/wrapper for custom headers
2. If headers need to be moved to a layout component
3. If Next.js 15 has changed how headers() works in next.config.ts
4. If there's a syntax issue with the CSP value causing silent failure