Does next-auth use JWT or sessions and where are they stored?

user_16524580 0
Viewed 41

I completely don't understand the next-auth documentation.

I understand you can use both JWT and sessions, but how do you tell next-auth which one you're using? And where does next-auth store its sessions or JWTs? On the server or client-side?

next-auth next.js
1 Answers

NextAuth.js uses a JWT to save the user's session by default, when a database adapter is not used.

NextAuth.js by default uses JSON Web Tokens for saving the user's session. However, if you use a database adapter, the database will be used to persist the user's session. You can force the usage of JWT when using a database through the configuration options. Since v4 all our JWT tokens are now encrypted by default with A256GCM.

The JWT is stored in an httpOnly cookie, not accessible on the client-side.

You can use JWT to securely store information you do not mind the client knowing even without encryption, as the JWT is stored in a server-readable-only cookie so data in the JWT is not accessible to third party JavaScript running on your site.

This is documented in NextAuth.js JSON Web Tokens FAQ section.

user_18707800
Related