How do you implement authentication in a Next.js App Router app?

Summary

Use a library such as Auth.js (NextAuth v5), Clerk, Better Auth or a custom session system: store sessions in HttpOnly cookies, read the session in Server Components/Actions/Route Handlers via cookies() or the library's auth(), and protect routes with server-side checks (optionally with middleware redirects).

Longer Answer

Centralize authorization in a data access layer (DAL) that verifies the session before returning data, so every page and action goes through it. Don't rely only on hiding UI or on middleware. Use secure, SameSite cookies, and for credentials auth hash passwords properly.

Key Points

• Session in HttpOnly cookies
• Check auth in server code near data access
• Data Access Layer pattern
• Middleware only for coarse redirects