This is the script I'm using:

const securityHeaders = [
  {
    key: 'X-XSS-Protection',
    value: '1; mode=block'
  },
  {
    key: 'Referrer-Policy',
    value: 'origin-when-cross-origin'
  }
]

module.exports = {
  async headers() {
    return [
      {
        // Apply these headers to all routes in your application.
        source: '/:path*{/}?',
        headers: securityHeaders,
      },
    ]
  },
}

But when I run npm run start and check the Response Headers for localhost, none of these headers appears.

Using next version 9.5.2