Next.js App Router Authentication

Lee starts with a minimal Next.js example that reads the session in an async server component and uses server actions for login and logout. The login function reads form data, looks up user information, creates a session, and stores it in an HTTP-only cookie.

The example signs a JWT with the Jose library, using a secret key that should be kept in an environment variable. Middleware checks for the session cookie, verifies it, and refreshes its expiration. The demo sets the cookie to expire after 10 seconds to show how expiration and renewal work.

The `getSession` function reads the session cookie and decrypts it to return session information. Logging out deletes the cookie. Lee describes this as a minimal starting point that developers can extend.

Lee then shows a NextAuth.js setup using the GitHub provider, catch-all route handlers, and the `auth`, `signIn`, and `signOut` functions. The demo creates a session token, callback URL, and CSRF token, while middleware refreshes the session and uses a route matcher to skip static assets.

Lee points to Next.js documentation covering authorization and protecting server actions and route handlers. He also mentions database sessions and examples using Clerk, Lucia, Auth0, and Supabase.