security-auth

NextAuth provides session management and JWT-based authentication out of the box. Configure it with secure cookie settings, set up providers (credentials, OAuth), and define your session strategy in your API route. This handles login, logout, and session validation across your app.

Use bcrypt with at least 12 rounds to hash passwords before storage. For password reset, generate a token with an expiration timestamp, store it hashed in your database, and send a reset link via email. Verify the token and expiration before allowing a new password.

CSRF protection requires verifying origin headers and using anti-CSRF tokens in forms. Implement rate limiting on sensitive endpoints—track requests per IP or user ID and reject requests exceeding your threshold. Both are essential for OWASP-aligned security.

Yes. Store JWT tokens in HTTP-only, secure cookies so they're automatically sent with requests but inaccessible to JavaScript. This combines JWT flexibility with cookie security, protecting against XSS attacks while maintaining stateless session validation.

Add headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security to prevent injection and clickjacking. Validate all user inputs (email format, password length, token format) before processing to block malformed or malicious requests.