Question 1

Where should session checks happen in a Next.js app?

Accepted Answer

Server Components, Server Actions, Route Handlers, and Middleware — defense in depth, not middleware alone. Middleware is a coarse gate; still authorize in data layer. Never trust client-only checks. Prefer httpOnly cookies for session tokens.

Question 2

Auth.js (NextAuth) vs custom JWT cookies — trade-offs?

Accepted Answer

Auth.js speeds providers/session patterns; custom gives control but you own security details. Consider session strategy (JWT vs DB), rotation, CSRF, and multi-tenant needs. Prefer battle-tested libraries unless requirements demand custom.

Question 3

How do you protect Server Actions that mutate user data?

Accepted Answer

Verify session, check resource ownership, validate input, and revalidate carefully. Pass IDs from the client but authorize against the session user. Rate-limit sensitive actions.

Question 4

What is the risk of caching authenticated RSC payloads?

Accepted Answer

User A could receive User B's data if personalized responses are stored in shared caches. Mark dynamic, use private cache, vary by cookie carefully, and test with two sessions. This is a critical security interview topic.

Question 5

How do OAuth callback routes fit App Router?

Accepted Answer

Usually Route Handlers under app/api/auth/... handling redirects and cookie sets. Ensure correct redirect URIs per environment. Handle error query params. Keep secrets in env only.

Question 6

Lead: design auth for a multi-tenant Next.js SaaS.

Accepted Answer

Org-aware sessions, middleware tenant resolution, server-side enforcement, audit logs, and SSO options. Isolate data by tenant at the query layer. Support invite flows and role claims. Plan for session revocation and SCIM later.

Authentication Next.js Interview Questions

Other Next.js interview topics