Next.js Authentication

Priority: P0 (CRITICAL)

Use HttpOnly Cookies for token storage. Never use LocalStorage.

Key Rules

1. Storage: Use cookies().set() with httpOnly: true, secure: true, sameSite: 'lax'.
   • Reference: Auth Implementation (See "Setting Tokens").
2. Access: Read tokens in Server Components via cookies().get().
   • Reference: Auth Implementation (See "Reading Tokens").
3. Protection: Guard routes in middleware.ts before rendering.
   • Reference: Auth Implementation (See "Middleware Protection").

Anti-Pattern: LocalStorage

• Security Risk: Vulnerable to XSS.
• Performance Hit: Incompatible with Server Components (RSC). Forces client hydration and causes layout shift.