Authentication & Authorization 🔐

Next.js gives you flexibility—pick the right auth stack, guard routes, and harden the app against common attacks.

Auth Approaches 🧭

NextAuth/Auth.js: plug-and-play providers (OAuth, email magic links, credentials). Stores sessions via JWT or database. Great for rapid prototyping.
Custom JWT: issue short-lived JWTs (signed with HS256/RS256). Store in httpOnly cookies or localStorage (less secure). Pair with refresh tokens.
Cookie Sessions: store session ID in secure, httpOnly cookie; map to server-side session store (Redis, DB).
OAuth: implement Authorization Code + PKCE for Google, GitHub, etc. Use next-auth or custom flows.
Passkeys/WebAuthn: advanced passwordless login using platform authenticators.

Authorization 🛂

RBAC (Role-based): assign roles (admin, editor) and check before actions.
ABAC (Attribute-based): decisions based on user attributes + resource metadata (department, region).
Route Guards:
- Middleware: check cookies/session before hitting route (redirect unauthorized).
- Server component checks: redirect('/login') if session missing.
- Client guards: hide UI, but never rely solely on them.
Keep secrets/data access server-side; client should only receive what it can display.

Security Fundamentals 🛡️

CSRF: use same-site cookies (SameSite=Lax), CSRF tokens for state-changing forms, or server actions (which are same-origin).
XSS: escape user content, use dangerouslySetInnerHTML sparingly, enable Content Security Policy, leverage React’s auto-escaping.
SSRF: whitelist outbound URLs when fetching user-provided endpoints.
Secure Cookies: httpOnly, secure, sameSite=strict|lax, set domain carefully, rotate secrets.
CSP: configure via next/headers or _document. Example: default-src 'self'; script-src 'self' 'nonce-XYZ';.
Rate Limiting: store counters in Redis/Upstash; enforce limits via middleware or edge workers. Combine with bot detection (hCaptcha, Cloudflare Turnstile).

Analogy: authentication is issuing passports, authorization is checking customs stamps, and security fundamentals are the airport scanners keeping the terminal safe.