sfnext-authentication

name	sfnext-authentication
description	Implement authentication in Storefront Next using split-cookie architecture, SLAS tokens, and auth middleware. Use when accessing user identity in loaders, detecting guest vs registered users, using getAuth or useAuth, or understanding session management and token refresh.

Authentication Skill

This skill covers Storefront Next's split-cookie authentication architecture with SLAS (Shopper Login and API Access Service).

Overview

Storefront Next uses a split-cookie architecture separating server and client auth concerns:

• Server middleware (auth.server.ts) — Manages SLAS tokens, writes cookies, handles token refresh
• React Context (AuthProvider) — Provides public session data (non-sensitive fields) to components via useAuth()

Cookie Design

Cookie	Purpose	User Type	Expiry	HttpOnly
cc-nx-g	Guest refresh token	Guest	30 days	No
cc-nx	Registered refresh token	Registered	90 days	No
cc-at	Access token	Both	30 min	No
usid	User session ID	Both	Matches refresh	No
customerId	Customer ID	Registered	Matches refresh	No

Key points: