Nextjs authentication

Skill FilippoDeSilva/skills/skills/nextjs/nextjs-authentication

Secure token storage (HttpOnly Cookies) and Middleware patterns. Use when implementing authentication, secure session storage, or auth middleware in Next.js.From its SKILL.md

Install

npx -y skills add FilippoDeSilva/skills --skill nextjs-authentication

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.2 KB, 354 tokens by cl100k_base, as published. Nobody here has run it

Authentication & Token Management

Priority: P0 (CRITICAL)

Use HttpOnly Cookies for token storage. Never use LocalStorage or sessionStorage.

Implementation Guidelines

Token Storage: Strictly use HttpOnly, Secure cookies with SameSite: 'Lax' or 'Strict'. Set reasonable maxAge (e.g., 86400). Never store access tokens in localStorage or sessionStorage (XSS-vulnerable). LocalStorage causes hydration issues in Server Components.
Access Management: Read and verify tokens in Next.js Middleware (middleware.ts) for edge-side redirection and route protection.
Next.js 15+ Async: cookies() Promise from next/headers and must awaited.
Library Selection: Prefer next-auth (Auth.js) or Clerk for social logins and session management.
Data Access: Always use DAL (Data Access Layer) to validate credentials and verify cookie presence before rendering.
CSRF Protection: Guard all Server Actions and Route Handlers by verifying Origin/Referer headers.
User Verification: Use await auth() (Auth.js) or custom getSession() helper in Server Components.