How I setup role based authorization Next Auth

My Products

Useful Links

[reignofrage]

cody your videos are so informative and helpful. It’s crazy because I open youtube and find one of ur vids that solves an exact problem of mine

[EdwardOrnelas]

Wow can’t wait for the kit! Multi level auth is something I’ve been needing for a specific project. I’ve been using the tables but this seems far for more streamlined and efficient

[sasquatch_devs]

I've added casl + casl/react on top of this and its a great combo!

[jonathanb.]

Thanks for the video. Which add-on are using to display errors directly next to the code?

[codinginflow]

Have you implemented your own refresh token mechanism to use JWTs in Next-auth?

[Dom-zyqy]

Have you ever had to implement quotas? Like, for a subscription system (not pay as you go).

Working on setting up something right now where I want the user to be able to perform X operations a month, based on their sub tier.

I imagined I could just create a sql query and count the operations the user has performed in the alloted time frame, but that doesn't seem ideal for a few reasons.

Maybe I make a "quotas" table with a period_start and period_end column, then deduct their quota? Im using stripe so I could also probably just use the web hook events to update their quota when they renew their sub or it cancels.

[Yahya_Umar]

Can you please create a stock register app using with multiple role it was really helpful if you could make it.

[PhillipLippi]

I really enjoyed the video! I have a question though:

Would it be feasible to create an auxiliary function for data fetching? My concern stems from the fact that for every request, I need to include the authentication token in the header. Consequently, in every page, I find myself having to retrieve the token from the cookie using next/headers.

I recall achieving this functionality with Axios and Next.js by setting the token within an Axios variable. Is it possible to replicate this behavior using the Fetch API?

OBS: I'm using an external backend application

[compton]

Thanks ❤.

Do you prefer Next Auth over Clerk?

[sakib]

Informative video.
I have a question though.
How can I integrate SAAS level i18n support in next js app router. so if user added more than one language they can see the translated route otherwise they will see no lang route by default.

[easylite]

How do you deal with changes while the user is logged in? So if somebody is changing your role in one group while you are logged in, how do you refresh the information on the token?

[Alex.Shalda]

in the video I clearly see how you extend the Session object, and it works for me, but could you please explain how you extend the default User object, and the Token object? On my User object there are default properties like id, name, image, email. How do I extend it, so I can grab other properties from my db? Thank you! Very useful video

[raymondmichael]

Thanks o
Cody, are you using Convex as database in this? I find it really hard to use nextauth with convex database, little help please 😢

[esp.luisantonio]

Congratulations! Is the project open source?

[RaduCiocan]

how do you deal with the case when user create a new group or join a group? You should somehow update the jwt token with the new data.

[ayukalvieri]

l'm looking to enhance the security of my Next.js app by implementing a feature where users need to re-enter their password before accessing routes displaying sensitive information or performing critical actions. How can I protect these routes to ensure that only authenticated users who have re-entered their password can access them?

[amosmachoradevlogs]

coincidentally this is like what im doing like right now. Great vid. Here is a video idea. How to use next auth with an external backend. Without nextjs built in backend if you get what im trying to say. because there is this backend guy i work with who built the jwt himself then in my next app i use next-auth so we are really confused on how to amalgamate the two strategies.

[versaleyoutubevanced]

This useSession got me thinking, it's synchronous, so there is no communication with external system, but still can decode the session. I wonder if it's using a public key to decode a non http only cookie... What's your thoughts on that?

[diegocarvallo]

Hey Cody - are there any concerns here from a security standpoint? Could a user alter their JWT to a new plan/role ? How do you make sure that these things cant be spoofed/intercepted

[mattd]

How do you refresh a JWT in the case a user is removed or added to a group?