MENU

Security

Security in a Next.js App Router application is spread across several layers, because the App Router itself gives you several places to run code: Middleware runs at the edge before a request reaches a route, Server Components render on the server and can read the current user before producing HTML, Server Actions mutate data in response to form submissions and other client calls, and Route Handlers expose plain HTTP endpoints under app/api. Each of these layers can participate in keeping an application secure, and none of them should be trusted to do the whole job alone.

This chapter walks through the core concepts you need before reaching for a library, and then surveys the libraries the community actually uses:

• Authentication — verifying who a user is, and where that logic belongs in an App Router project.
• Session Management — keeping a user recognized across requests once they've signed in.
• Authorization — deciding what a signed-in user is allowed to see or do.
• Authentication Libraries — Auth.js, Clerk, Lucia, and Better Auth.
• Session Management Libraries — lighter-weight libraries like iron-session that only handle the session cookie.
• XSS Attacks — Cross-Site Scripting, and where it can still slip past React's default protections.
• CSRF Attacks — Cross-Site Request Forgery, and what Next.js does and doesn't protect against automatically.
• The Copenhagen Book — a free, framework-agnostic reference for going deeper on auth and session fundamentals.

None of this is exhaustive treatment of web security — it's an orientation to how the App Router's building blocks map onto familiar security concerns, so you know which primitive to reach for and where to read further.