Role Based Authorization with Next-Auth and Next.js 13

[jackfrosch]

Good stuff. Thanks. I know this is a simple tutorial, but if you ever edit this video, I recommend stressing the importance of not storing plaintext passwords in the database. Hashing them before storage and always querying with a hashed password is a much more secure practice. Thanks again!

[stevemcqueen]

Thank you for doing these nextjs next-auth videos with your own API. Not much content on this stuff! Especially the roles! I only wish you had refresh tokens as well 🤣

[sprng]

Thanks for such a good video, it was exactly what I need. It would be cool, if you make video about refresh token in nextjs, I doesn't see much stuff about it

[yuhiahtyun]

Dude ! you're live saver. Thanks a lots

[tunghoang]

Awesome! Thanks for your helpful tutorial :)

[Grishopping]

Greetings, thanks for the video... I speak little English, I use a translator... but I understand everything... you explain very well

You could make one more video with next + next-auth + prisma + mongodb and that the keys are encrypted

P, D; and as a BONUS you put good practices to avoid CSRF attacks I would appreciate it... many blessings

att. Jose Grillo from Venezuela

español
saludos gracias por el hablo poco ingles uso traductor.... pero voy entendiendo todo... explicas muy bien

podrias hacer un video mas con next + next-auth + prisma + mongodb y que las claves esten encriptadas

att. Jose Grillo desde Venezuela

[UAng-rokt]

Thanks very much!!! There is a problem. When adding withAuth(...) in middleware.ts file, "export async function middleware(req: NextRequest)" function in middleware.ts will not be executed which is used for logging http request, seems they conflict with each other. It works fine when removing withAuth(...) Do you know any solution for this? Thank you.

[riccohen]

Fantastic tutorial👌👌👌. My only question is once you send the access token the backend, what is it doing with it? Is it searching the database for a user with that token and see if it exists?

[meaninglesspain]

Hi, what should i do if i no want to show the callbackURL?

[mediacreatif]

I would suggest to redirect to a 404 page if a simple USER try to connect to the ADMIN PAGE, instead of showing an unauthorization message.

[SagarKumar-dbxy]

Is there a way we can send a set of URL's that only admin can access?

[bnejgop]

What if the access token expires? How do we handle that case? Suppose you try to access a user's post, but the token stored in the session has expired. We can handle that without interrupting the user flow.

When the access token expires and the user tries to access their post, we already know that a refresh token is stored in cookies, which is HTTP-only. The server sets this token on login for a long time period. We can use the refresh token to get a new access token without the user having to log in again.

[cryptobeaver]

Can. you do it without TS? i can't find any documentation for doing it without TS

[ICOReviewtoken]

How do i write if i use multi language en/admin

[asrii]

i cant able to run this on my end, coz the db repo is lack of details on how to setup

[raymondmichael]

Hello!,
I'm having trouble adding those additional fields to the session. I have added types/next-auth.d.ts as you did { user: User } but I only get {name, email, image} as before

and my User type contains all fields.
in the session callback, session.user also contains all the fields as per User type, and I return the session from here.

What'd I be doing wrong; Thanks

[matheusdesousamenezes]

Wonderful tutorial! Just one question...

Is it possible to override the token that next-auth generates, with a token that comes from the backend? I did a solution and from what i saw, it has the same result as your repo:

One token is stored in the cookies
One token is obtained by the api

Is this okay in terms of good practices?

[Vicky]

In Next Video:- Verify token from server and redirect user if he is already logged in

[mediacreatif]

I'm trying to redirect an ADMIN to the ADMIN PAGE. If an ADMIN is connected, he is redirected to the ADMIN PAGE. If it's an USER, he is redirected to the USER PROFILE PAGE.

I think I have to change the callbackUrl from the signIn function in the LoginPage. The callbackUrl has to be different according to the User Role. But how can I retrieve the User Role in this LoginPage ?

Thanks.

[RohitSaini-gocr]

Is there any way I have have Role Based Access Control with GoogleProvider ?