NextJS Security Best Practices Syllabus

Security Best Practices syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Best Practices in NextJS, not a summary of it.

1. 1

   Authentication and Authorization

   3 topics

   • Using NextAuth.js
   • JWT Tokens
   • Role-Based Access Control
2. 2

   Data Protection

   3 topics

   • Protecting API Routes
   • Handling Sensitive Data
   • Using HTTPS
3. 3

   Vulnerability Management

   3 topics

   • Regular Audits
   • Using Security Headers
   • Dependency Management

Security Best Practices flashcards for NextJS

19 of 51 cards from the Security Best Practices deck — real questions with worked answers.

1. What is NextAuth.js (Auth.js) and what problem does it solve in a Next.js application?

   It is an open-source authentication library for Next.js that handles sign-in flows, sessions, and account linking. It provides built-in support for OAuth providers, email/passwordless login, and credentials, abstracting away token handling, CSRF protection, and session management.

2. Which two session strategies does NextAuth.js support, and how do they differ?

   The 'jwt' strategy stores session data in an encrypted JWT held in a cookie (stateless, no DB lookup). The 'database' strategy stores sessions in a database and keeps only a session token in the cookie (stateful, revocable server-side).

3. In NextAuth.js, what is the purpose of the 'jwt' and 'session' callbacks?

   The 'jwt' callback runs whenever a token is created/updated and lets you add custom claims (e.g. role, id) to the token. The 'session' callback shapes the session object returned to the client, letting you expose selected token fields to the frontend.

4. What environment variable does NextAuth.js require to encrypt/sign tokens and cookies, and why must it be kept secret?

   NEXTAUTH_SECRET (or AUTH_SECRET). It is used to sign/encrypt JWTs and CSRF/session cookies. If leaked, an attacker can forge valid session tokens and impersonate any user.

5. Where should you place the NextAuth.js configuration route in a Next.js App Router project?

   In app/api/auth/[...nextauth]/route.ts, exporting the handlers (GET and POST) generated from the auth configuration. This catch-all route handles sign-in, callback, sign-out, and session endpoints.

6. How do you read the current user's session on the server in the Next.js App Router with NextAuth.js?

   By calling the auth() helper (or getServerSession(authOptions)) inside a Server Component, Route Handler, or Server Action, which returns the session object or null if unauthenticated.

7. What does JWT stand for, and what are its three dot-separated parts?

   JSON Web Token. Its three Base64URL-encoded parts are the Header, the Payload (claims), and the Signature, joined as header.payload.signature.

8. What information does the header of a JWT typically contain?

   The token type ("typ": "JWT") and the signing algorithm ("alg"), for example HS256 or RS256, used to compute and verify the signature.

9. Why should you never store sensitive secrets in a JWT payload?

   Because the payload is only Base64URL-encoded, not encrypted, so anyone who possesses the token can decode and read the claims. The signature only guarantees integrity, not confidentiality.

10. What is the difference between symmetric (HS256) and asymmetric (RS256) JWT signing algorithms?

    HS256 (HMAC-SHA256) uses a single shared secret for both signing and verification. RS256 (RSA-SHA256) uses a private key to sign and a corresponding public key to verify, so verifiers never need the signing secret.

11. What do the standard JWT claims 'exp', 'iat', and 'nbf' represent?

    'exp' is the expiration time (token invalid after this), 'iat' is the issued-at time, and 'nbf' is the not-before time (token invalid before this). All are NumericDate values in seconds since the Unix epoch.

12. How is a JWT signature computed for an HMAC-based algorithm like HS256?

    $$\text{signature} = \mathrm{HMACSHA256}\big(\text{base64url}(header) + \texttt{.} + \text{base64url}(payload),\ secret\big)$$

13. In a JWT-based auth system, what is the purpose of pairing a short-lived access token with a long-lived refresh token?

    The short-lived access token limits the exposure window if it is stolen, while the refresh token (stored more securely and revocable) is used to obtain new access tokens without forcing the user to log in again.

14. Define Role-Based Access Control (RBAC).

    An authorization model in which permissions are assigned to roles rather than to individual users, and users are granted access by being assigned one or more roles. Access decisions are made by checking whether a user's role holds the required permission.

15. In RBAC, what are the three core entities and how are they related?

    Users, Roles, and Permissions. Users are assigned Roles (user-role assignment), and Roles are granted Permissions (role-permission assignment); users inherit permissions through their roles.

16. How does RBAC differ from ABAC (Attribute-Based Access Control)?

    RBAC grants access based on a user's assigned roles. ABAC grants access based on evaluating attributes (of user, resource, action, and environment) against policies, allowing finer-grained, context-aware decisions but with more complexity.

17. What is the principle of least privilege, and how does RBAC support it?

    It states that every user/process should have only the minimum permissions necessary to perform its function. RBAC supports it by letting administrators define narrow roles and assign users only the roles they need.

18. In a Next.js app using NextAuth.js, how can you attach a user's role to their session for RBAC checks?

    Add the role to the token in the 'jwt' callback (e.g. token.role = user.role), then expose it in the 'session' callback (e.g. session.user.role = token.role) so it can be checked on the server.

19. What is the difference between authentication and authorization?

    Authentication verifies WHO a user is (identity, e.g. via login). Authorization determines WHAT an authenticated user is allowed to do (permissions/access). Authentication must precede authorization.

See more Security Best Practices flashcards →

Planning Security Best Practices for NextJS

Security Best Practices (NextJS) FAQ