asked 4 months ago
2
15.3K
I'm implementing JWT-based auth in a Next.js app. I've read conflicting advice about where to store the JWT:
What's the recommended approach in 2024 for a production app? Does it change if I'm using NextAuth?
Worth adding: the "memory only" approach (storing in a JS variable) has one practical use — short-lived access tokens in a refresh-token flow. You keep the refresh token in an httpOnly cookie, and the access token only in memory. On page refresh you silently re-issue the access token. This is the most secure pattern but adds complexity. For most apps, httpOnly cookies with a good session library (like NextAuth or Lucia Auth) is the right call.
54
4
• answered 2 months ago
The modern consensus (2024): httpOnly cookies + CSRF protection.
Here's why:
SameSite=Lax cookie attribute (the default in modern browsers) + a CSRF token for mutating requests.For NextAuth specifically: it handles all of this for you. It stores the session in an httpOnly cookie by default. Don't fight it.
// next-auth configuration — this is the secure default:
cookies: {
sessionToken: {
options: {
httpOnly: true,
sameSite: 'lax',
path: '/',
secure: process.env.NODE_ENV === 'production',
}
}
}1
27
2