Nextjs authentication

Skill FilippoDeSilva/skills/skills/nextjs/nextjs-authentication

Skills for my agentic development workflow.

Install

npx -y skills add FilippoDeSilva/skills --skill nextjs-authentication

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Secure token storage (HttpOnly Cookies) and Middleware patterns. Use when implementing authentication, secure session storage, or auth middleware in Next.js.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.2 KB, as published. Nobody here has run it

Authentication & Token Management

Priority: P0 (CRITICAL)

Use HttpOnly Cookies for token storage. Never use LocalStorage or sessionStorage.

Implementation Guidelines

Token Storage: Strictly use HttpOnly, Secure cookies with SameSite: 'Lax' or 'Strict'. Set reasonable maxAge (e.g., 86400). Never store access tokens in localStorage or sessionStorage (XSS-vulnerable). LocalStorage causes hydration issues in Server Components.
Access Management: Read and verify tokens in Next.js Middleware (middleware.ts) for edge-side redirection and route protection.
Next.js 15+ Async: cookies() Promise from next/headers and must awaited.
Library Selection: Prefer next-auth (Auth.js) or Clerk for social logins and session management.
Data Access: Always use DAL (Data Access Layer) to validate credentials and verify cookie presence before rendering.
CSRF Protection: Guard all Server Actions and Route Handlers by verifying Origin/Referer headers.
User Verification: Use await auth() (Auth.js) or custom getSession() helper in Server Components.

Example: Auth Middleware

See implementation examples

Example: HttpOnly Cookie Setup

See implementation examples

Anti-Patterns

No localStorage for tokens: XSS-vulnerable and causes hydration issues.
No raw tokens in Client Components: Pass session state, not tokens.
No unprotected Server Actions: Always verify Origin/Referer headers.

References

Auth Implementation Examples

Gives 1 of the 12 instructions most auth identity skills give

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

hash passwords with bcrypt or argon2in 53 of 409, across 43 files
use parameterized queriesin 47 of 409, across 39 files
load SECRET_KEY from environment variablesin 23 of 409, across 14 files
validate all input server-sidein 19 of 409, across 11 files
refresh access tokens before expiryin 17 of 409, across 9 files
store tokens in httponly cookieshere, and in 17 of 409, across 16 files
store refresh tokens securelyin 16 of 409, across 6 files
validate webhook signatures before processingin 15 of 409, across 5 files
sanitize user inputsin 15 of 409, across 9 files
implement rate limiting on auth endpointsin 14 of 409, across 9 files
encrypt sensitive data at restin 13 of 409, across 10 files
validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

set reasonable cookie maxAge values
verify tokens in Next.js middleware
await the cookies() promise in Next.js
use a Data Access Layer for validation
verify Origin/Referer headers on Server Actions
use next-auth or Clerk for session management

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.