| name | Next.js Authentication |
|---|---|
| description | Secure token storage (HttpOnly Cookies) and Middleware patterns. |
| metadata | {"labels": ["nextjs", "auth", "security", "cookies"], "triggers": {"files": ["middleware.ts", "**/auth.ts", "**/login/page.tsx"], "keywords": ["cookie", "jwt", "session", "localstorage", "auth"]}} |
Authentication & Token Management
Priority: P0 (CRITICAL)
Use HttpOnly Cookies for token storage. Never use LocalStorage.
Key Rules
- Storage: Use
cookies().set()withhttpOnly: true,secure: true,sameSite: 'lax'. - Reference: Auth Implementation (See "Setting Tokens"). - Access: Read tokens in Server Components via
cookies().get(). - Reference: Auth Implementation (See "Reading Tokens"). - Protection: Guard routes in
middleware.tsbefore rendering. - Reference: Auth Implementation (See "Middleware Protection").
Anti-Pattern: LocalStorage
- Security Risk: Vulnerable to XSS.
- Performance Hit: Incompatible with Server Components (RSC). Forces client hydration and causes layout shift.