MENU

The Copenhagen Book

Everything in this chapter has been framed around Next.js specifically: which file, which function, which flag. The concepts underneath — password hashing, session tokens, OAuth, CSRF, credential stuffing — belong to web application security generally, and they're worth understanding independently of any one framework's APIs.

The Copenhagen Book is a free, open reference guide covering exactly that: the fundamentals of authentication and session security, written to be framework-agnostic rather than tied to any particular library or stack. It goes considerably deeper than a framework's own documentation typically does on topics like:

• password hashing algorithms and why some common choices are unsafe
• session token design, storage, and rotation
• the mechanics and pitfalls of OAuth/OIDC flows
• CSRF, and the reasoning behind cookie attributes like SameSite
• email verification, password reset flows, and multi-factor authentication

It's a good next stop once the Next.js-specific material in this chapter — Authentication, Session Management, Authorization, XSS Attacks, and CSRF Attacks — feels familiar, and especially useful if you're evaluating or building your own authentication logic rather than relying entirely on one of the authentication libraries covered earlier. The site is maintained as a living reference rather than a one-time article, so it's worth bookmarking rather than reading once and setting aside.