Auth and Deployment Questions
How do you implement authentication in Next.js?
Commonly with Auth.js (NextAuth v5): an auth.ts config with providers (Google, Credentials), a catch-all route handler for /api/auth/*, and auth() to read the session in Server Components, Route Handlers, Server Actions and middleware. Add roles via the jwt/session callbacks and module augmentation of the Session type.
Is protecting routes in middleware enough?
No. Middleware is a good first gate (redirect guests), but you must also verify the session where data is read or written: in pages, Server Actions, Route Handlers or a Data Access Layer. Layouts do not re-run on every navigation and actions can be called directly, so a check only in a layout or middleware can be bypassed.
JWT sessions vs database sessions?
JWT: session data in an encrypted/signed cookie, no DB lookup, works at the edge, but hard to revoke before expiry. Database sessions: cookie holds an id, every request reads the session table, easy to revoke (logout all devices). Choose JWT for scale and simplicity, DB sessions when instant revocation matters (banking, admin tools).
How do you deploy Next.js without Vercel?
Use output: 'standalone' and a multi-stage Docker image (copy public and .next/static), or run next start under pm2 behind nginx with HTTPS. Considerations: sharp for images, a shared cache handler (Redis) when running several instances, proxy_buffering off for streaming, health checks, env vars set at build time for NEXT_PUBLIC_*.