new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Next.js · Guides · all subjects

authentication & server actions

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Three core authentication concepts

Authentication verifies if the user is who they say they are by requiring proof of identity with something they have, such as a username and password. Session management tracks the user's auth state across requests. Authorization decides what routes and data the user can access.

Why use authentication libraries instead of custom solutions

While you can implement custom auth, for increased security and simplicity, it is recommended to use an authentication library. These offer built-in solutions for authentication, session management, and authorization, as well as additional features such as social logins, multi-factor authentication, and role-based access control.

Delete session on logout

To delete a session, use the Next.js cookies API to delete the session cookie. Call cookieStore.delete('session') in a deleteSession function, then invoke this function in a logout Server Action followed by a redirect to the login page.

Auth libraries list

Recommended authentication libraries for Next.js include: Auth0, Better Auth, Clerk, Descope, Kinde, Logto, NextAuth.js, Ory, Stack Auth, Supabase, Stytch, and WorkOS.

Auth and streaming in layouts

A top-level await on cookies(), headers(), or the DAL in a layout delays the first streamed chunk and holds children behind that work. If only part of the shell needs session data (e.g., a user menu), move the await into a nested Server Component and wrap it in Suspense so the rest of the page streams first.

Server Action with session re-verification

Example Server Action pattern: 'use server'; import { redirect } from 'next/navigation'; import { updateTag } from 'next/cache'; import { getSession } from '@/lib/session'; import { saveNote } from '@/lib/data'; export async function addNote(formData: FormData) { const { userId } = await getSession(); if (!userId) { redirect('/login'); } const note = String(formData.get('note') ?? '').trim(); if (note) { await saveNote(userId, note); updateTag(`notes:${userId}`); } }

Give your agent this brain