nextjs-authentication

name	nextjs-authentication
description	Secure token storage (HttpOnly Cookies) and Middleware patterns. Use when implementing authentication, secure session storage, or auth middleware in Next.js. (triggers: middleware.ts, **/auth.ts, **/login/page.tsx, cookie, jwt, session, localstorage, auth)

Authentication & Token Management

Priority: P0 (CRITICAL)

Use HttpOnly Cookies for token storage. Never use LocalStorage or sessionStorage.

Implementation Guidelines

• Token Storage: Strictly use HttpOnly, Secure cookies with SameSite: 'Lax' or 'Strict'. Set reasonable maxAge (e.g., 86400). Never store access tokens in localStorage or sessionStorage (XSS-vulnerable). LocalStorage causes hydration issues in Server Components.
• Access Management: Read and verify tokens in Next.js Middleware (middleware.ts) for edge-side redirection and route protection. Use NextRequest to get cookies and NextResponse.redirect for unauthorized users. Use matcher in config for route protection.
• Next.js 15+ Async: Remember that cookies() is a Promise from next/headers and must be awaited: const cookieStore = await cookies();. Access values via . to Client Components.