new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Next.js · Guides · all subjects

authentication & server security

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Environment poisoning prevention

JavaScript modules can be shared between both Server and Client Components modules. It's possible to accidentally import server-only code into the client. To prevent accidental usage in Client Components, use the server-only package. If you try to import a module marked with 'server-only' into a Client Component, there will be a build-time error.

Environment variables exposed to client

In Next.js, only environment variables prefixed with NEXT_PUBLIC_ are included in the client bundle. If variables are not prefixed, Next.js replaces them with an empty string. This means server-only environment variables like API keys will not be accessible in the client even if the code tries to use them.

server-only and client-only packages

The server-only package can be imported into files that contain server-only code to prevent accidental imports into Client Components. The corresponding client-only package can be used to mark modules that contain client-only logic like code that accesses the window object. In Next.js, installing these packages is optional but recommended. Next.js handles these imports internally to provide clearer error messages when a module is used in the wrong environment. Next.js provides its own type declarations for server-only and client-only for TypeScript configurations where noUncheckedSideEffectImports is active.

Three core authentication concepts

Authentication, session management, and authorization are the three foundational concepts for protecting applications. Authentication verifies if the user is who they say they are. Session management tracks the user's auth state across requests. Authorization decides what routes and data the user can access.

Auth libraries for simplified implementation

Authentication libraries like Auth0, Clerk, NextAuth.js, Supabase, and others provide built-in solutions for authentication, session management, and authorization, as well as additional features such as social logins, multi-factor authentication, and role-based access control. Using these libraries is recommended over implementing custom auth solutions for increased security and simplicity.

Give your agent this brain