Authentication & Authorization Skill

Authentication: prefer a managed/battle-tested library over hand-rolled

Default recommendation for Next.js: Auth.js (NextAuth), Clerk, or Better Auth — hand-rolling password hashing, session handling, and OAuth flows is a security liability unless there's a specific reason to. If the user insists on custom auth, still use vetted primitives (bcrypt/argon2 for hashing, jose for JWT) and never invent your own crypto.

Session strategy

• Cookie-based sessions (httpOnly, secure, sameSite=lax/strict) are the default for web apps — not localStorage-stored JWTs, which are vulnerable to XSS token theft.
• If JWTs are required (e.g. for a separate API consumed by mobile), keep them short-lived (~15 min) with a refresh token rotated and stored httpOnly, not in localStorage/sessionStorage.
• Validate the session on the server on every protected request — never trust a client-supplied "isLoggedIn" flag.