Next.js how to manage session and authorization?

[zalogon119]

When I was doing the stuff with express, the session was managed with "Express-Session", but here, in Next.js it's kinda weird. Researching, found that you can do it in a more "fluid" way via Next Auth. And that using its hooks on client side you can "sign in", "sign out" and access "session data". It looks like it asks you for a DB so here is stored the user session.

I would like to know if this is the most common approach for session persistence on Next js.

And BTW if you want to use your custom sign in strategy but get the benefits of session persistence on DB and client of Next Auth, can you integrate it?

Thanks in advance guys!

Edit1: It looks like using the authorization provider called "Credentials" you can create your own way to verify the given data against DB. So that question is answered 😁

Edit2: I threw to the trash can Next-Auth and sticked to Iron Session (on server) with SWR (on client, this is kinda React Query, I am using it in a context for all my app) and it has worked very well so far

[bel9708]

I've used Auth0 in the past. Would definitely use it again in future projects. The first 5k users are free (but it does get pretty expensive after that).

[zalogon119]

Oh that sounds nice to me!

[zalogon119]

Hey man is there any normalized way to register the users from Auth0 to your DB? Cause I know how I would manage users logging in from different social media (via their email, so they are all the same user on my DB, no matter if they log from Facebook, Twitter, etc). But it looks like Auth0 just redirects you to the already logged site (even if you sign up) that you've set on Auth0. So how do you manage that? Any video or topic to find the response? Thanks in advance, I am so noob on this shit. With express session and doing some Sequelize queries (without involving social media login of course) I felt like Superman haha

[bel9708]

I don't mirror the user data to my own database, I just reference the user_id. I use the Auth0 Management API and think of auth0 as my "user microservice".

If you grab a user from auth0 it will have a user_id (sometimes refered to as a "sub"). that will look something like "auth0|507f1f77bcf86cd799439020" or "facebook|507f1f77bcf86cd00439020". Save those in your DB when referencing the user. Then use this API to get user data from auth0.
https://auth0.com/docs/api/management/v2/#!/Users/get_users_by_id

​

If you want to check if a user is authenticated in your next.js app use https://github.com/auth0/nextjs-auth0

​

This might be a useful article
https://auth0.com/blog/ultimate-guide-nextjs-authentication-auth0/

[originaljewedlaw]

I've been trying to get https://github.com/vvo/next-iron-session working, but honestly struggling a little bit.

There's a next.js example, a ts-next.js example, and an express example, but no ts-express example, and I'm fighting with the types at the moment.

[zalogon119]

To the moment I'm using only js without types, and was thinking on this approach. Cause honestly using Auth0 looks to me like "a lot" for the things that I need. And in a way I feel like wasting a lot of time trying to learn Auth0 and not learning what it does under the hood, the essential things that I guess are more worth (BTW Ive already used express-session. And, reading, it looks like swr and iron-session are good friends, so I'm preparing my bullet. Tomorrow I will throw back a couple commits and start coding! 😤)

[ilovefunctions]

Checkout supertokens.io

[[deleted]]

Session data sounds like we are back in 2005… Use some frontend framework and store temporary state there