Next.js Authentication Strategies

grill_gus

I've been trying to implement a reliable authentication flow for a Next.js project but I'm completely lost now. I've already seen the examples repo of Next.js. But I have a lot of questions for a complete solution. I have a express.js API and a separate Next.js frontend project. All the data and the authentication is handled by the API. Frontend just renders the pages with SSR. If I would just create a monolith project, where rendering the pages...

Originally asked by Onur Önder on Stack Exchange (stackoverflow) (CC BY-SA 4.0).

uphilltech

Great question — answering as the UphillTech team:

Disclaimer: I am a maintainer of the free open source package below, but I think it's appropriate here as it's a common question there isn't a great answer for, as many of the popular solutions have the specific security flaws raised in the question (such as not using CSRF where appropriate and exposing Session Tokens or web tokens to client side JavaScript). The package NextAuth.js attempts to address the issues raised above, with free open source software. It uses httpOnly cookies with secure . It has CSRF protection (double submit cookie method, with signed cookies). Cookies are prefixed as appropriate (e.g. __HOST- or __Secure ). It supports email/passwordless signin and OAuth providers...

Full answer by Iain Collins: https://stackoverflow.stackexchange.com/a/62344334 (CC BY-SA 4.0).

Need it done for your business? UphillTech.