7. Authentication - A Detailed Guide (Overview)

The foundation of Authentication (AuthN) and Authorization (AuthZ) before reading 8. NextAuth v5 and 9. JWT Dual Auth.

Read in order: 7 (this file) → 8 (NextAuth) → 9 (JWT Nova) → 6 (Middleware).

Docs: Authentication Guide

Table of Contents

1. AuthN vs AuthZ
2. Three phases in a real app
3. Session storage models
4. Access + Refresh token
5. Where to store the token - cookie vs localStorage
6. OAuth / Google login - the idea
7. Credentials login - the idea
8. Layered defense (Next.js recommendation)
9. What model does Nova Shop use?
10. FAQ & exercises

1. AuthN vs AuthZ

Common confusion: Being logged in (AuthN) ≠ being allowed to edit someone else's order (AuthZ).

2. Three Phases in a Real App

┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ 1. Login     │ →  │ 2. Session   │ →  │ 3. API call  │
│ verify user  │    │ holds state  │    │ sends token  │
└──────────────┘    └──────────────┘    └──────────────┘

3. Session Storage Models

A. Server-side session (sessionId cookie)

Client: cookie sessionId=abc
Server: DB sessions[abc] = { userId, ... }

B. Stateless JWT

Client: cookie token=eyJhbG...
Server: verify signature, read claims - no DB lookup

C. Dual token (Nova backend)

See section 4 - short-lived access + long-lived refresh.

4. Access + Refresh Token

Why not one long-lived token? The access token is exposed on many requests → a smaller attack window.

5. Where to Store the Token - Cookie vs localStorage

Nova's cookie flags:

httpOnly: true,
secure: production,
sameSite: "lax",

CSRF: sameSite: lax + a Server Actions origin check reduce the risk of the cookie being sent automatically from a foreign site.

6. OAuth / Google Login - The Idea

User → NextAuth redirects to Google
     → Google returns an authorization code / id_token
     → NextAuth signIn callback
     → Nova POSTs /google { idToken } to NestJS
     → NestJS verifies with Google, returns a JWT
     → setAuthCookies

Never just trust the client-side token - the backend verifies the id_token.

7. Credentials Login - The Idea

Email/password form
  → Server Action authenticate()
  → signIn("credentials")
  → authorize() → POST /login NestJS
  → setAuthCookies
  → redirect /products

The password is never stored on Next.js - it's only forwarded to the API.

Validation: Zod in authorize (email, password min 6 characters).

8. Layered Defense (Next.js Recommendation)

Layer 1 - middleware.ts
         Cookie + NextAuth? → redirect to /login early

Layer 2 - Server Component / Action
         authFetch, unauthorized() on 401

Layer 3 - NestJS API
         Verify JWT, ownership (this user's own cart)

Middleware alone isn't enough - an attacker could call a Server Action directly.

Data Access Layer pattern (docs): group auth checks close to where data is read - Nova's equivalent is authFetch + the services layer.

9. What Model Does Nova Shop Use?

┌─────────────────────────────────────────┐
│ NextAuth v5 (JWT session)               │  ← UX, useSession, middleware
├─────────────────────────────────────────┤
│ HttpOnly cookies (access + refresh)   │  ← authFetch → NestJS
├─────────────────────────────────────────┤
│ NestJS JWT validation                   │  ← business source of truth
└─────────────────────────────────────────┘

This is "dual auth" / a BFF - more complex than an Auth.js-only tutorial, but reasonable when an API already exists.

10. FAQ & Exercises

FAQ

Q: What is AUTH_SECRET used for?
Signs the NextAuth session JWT - required in production.

Q: What does logging out clear?
The signOut event → POST /logout to NestJS + clearAuthCookies.

Q: Can I just use NextAuth and drop the backend JWT?
Only if the API also trusts the NextAuth session - Nova's API needs its own Bearer token.

Exercises

1. What's the difference between AuthN and AuthZ, using /cart as an example?
2. Why isn't the refresh token sent with every product list request?

Next: 8. NextAuth v5 · 9. JWT Cookies