security

NextAuth.js v5 split-config separates Edge-safe logic in auth.config.ts from Node runtime logic in auth.ts, enabling middleware authorization to access required session data. This architecture supports secure RBAC route guarding and server-side session verification.

Implement RBAC route guarding by enforcing route-level access via the authorized() callback in middleware, and action-level access via server actions or API logic. This enforces least-privilege checks and ensures server-side session verification across your Next.js application.

Validate input in server actions by applying Zod parsing at every entry point to strictly validate data boundaries. Prevent common web attacks by using safe query building without SQL interpolation, handling XSS, and enforcing CSRF checks for API routes.

Yes, this security hardening applies to apps using middleware, server actions, and API routes. It enforces Edge-safe callbacks, role-based access control, input validation, rate limiting, and safe logging across these boundaries to prevent unauthorized access and common attacks.

You need Zod validation at API boundaries to parse and sanitize incoming data before it reaches your application logic. Parsing at boundaries prevents malformed input from causing SQL interpolation vulnerabilities, XSS, and other common web attacks.