auth-patterns

Implement NextAuth v5 authentication and authorization for Next.js applications.

Updated Mar 18, 2026
One-click install
npx skills add https://github.com/dr-code/beacon --skill auth-patterns-dr-code
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: auth-patterns
Source: https://github.com/dr-code/beacon/tree/main/plugins/nextjs-expert/skills/auth-patterns
Command: npx skills add https://github.com/dr-code/beacon --skill auth-patterns-dr-code

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Provides clear, production-ready patterns to implement authentication and authorization in Next.js applications, removing uncertainty about providers, sessions, middleware, and role checks so teams can secure pages and APIs consistently.

Core Features & Use Cases

  • NextAuth (Auth.js) configuration with OAuth and credentials providers to enable sign-in flows and session callbacks.
  • Middleware-based route protection and JWT verification patterns for server-side and edge protection of pages and API routes.
  • Session management strategies including stateless JWTs and database-backed sessions, with examples for refresh, rotation, and cookie configuration.
  • Role-based access control and extended types to protect admin/editor areas and enforce authorization in server components and actions.
  • Use Case: Protect a dashboard and API endpoints while allowing OAuth sign-in, issuing secure cookies, and enforcing admin-only routes.

Quick Start

Set up NextAuth with a GitHub provider, enable middleware that protects /dashboard and /api/protected, and verify sessions on the server before rendering.

Frequently Asked Questions about auth-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up NextAuth v5 with OAuth and credentials providers in Next.js?

NextAuth v5 setup in Next.js involves configuring OAuth and credentials providers to enable sign-in flows and session callbacks. You define provider configurations and session strategies to issue secure cookies for authenticated users.

How does middleware-based route protection work for Next.js pages and API routes?

Middleware-based route protection in Next.js uses JWT verification patterns to secure pages and API routes on the server and edge. It checks for valid session tokens before rendering or processing requests for protected paths.

What is the best way to implement role-based access control in Next.js server components?

Role-based access control in Next.js is implemented using extended types and session callbacks to enforce authorization. This protects admin and editor areas by checking user roles within server components and server actions before granting access.

When should I use JWT sessions versus database-backed sessions in Next.js authentication?

Use stateless JWT sessions for scalable, edge-compatible Next.js authentication without database lookups. Choose database-backed sessions when you need server-side session revocation, refresh, and rotation capabilities for your application.

Does this Next.js authentication pattern support secure cookies and CSRF mitigation?

Yes, Next.js authentication patterns include security best practices like secure cookie configuration and CSRF mitigation. These practices ensure that session tokens are protected during transit and vulnerable to cross-site request forgery.

Why are my protected routes failing JWT verification in Next.js middleware?

Protected routes fail JWT verification in Next.js middleware when session tokens are missing, expired, or improperly signed. Ensure your middleware correctly intercepts paths and your NextAuth configuration issues valid, secure cookies.