Authentication in Modern Web Applications: A Complete Guide

Login Server Action

// actions/auth.actions.ts
"use server";

import { z } from "zod";
import { cookies } from "next/headers";
import { prisma } from "@/lib/prisma";
import { generateToken, verifyPassword } from "@/lib/auth";

const LoginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
});

export async function loginAction(
  prevState: { error?: string; success?: string },
  formData: FormData
) {
  const validated = LoginSchema.safeParse({
    email: formData.get("email"),
    password: formData.get("password"),
  });

  if (!validated.success) {
    return { error: validated.error.errors[0].message };
  }

  const user = await prisma.user.findUnique({
    where: { email: validated.data.email, deletedAt: null },
  });

  if (!user || !(await verifyPassword(validated.data.password, user.password))) {
    return { error: "Invalid email or password" };
  }

  const token = await generateToken({
    id: user.id,
    email: user.email,
    role: user.role,
  });

  const cookieStore = await cookies();
  cookieStore.set("token", token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    maxAge: 7 * 24 * 60 * 60, // 7 days
    path: "/",
  });

  return { success: "Login successful" };
}

Role-Based Access Control (RBAC)

Our platform has 4 distinct user roles:

const ROLE_ROUTES: Record<string, string[]> = {
  SUPER_ADMIN: ["/admin/**"],
  CLIENT: ["/portal/**"],
  CUSTOMER: ["/account/**"],
  AFFILIATE: ["/affiliate-portal/**"],
};

// In middleware
export async function middleware(request: NextRequest) {
  const token = request.cookies.get("token")?.value;
  const user = token ? await verifyToken(token) : null;
  const { pathname } = request.nextUrl;

  // Check route access
  for (const [role, routes] of Object.entries(ROLE_ROUTES)) {
    const isProtected = routes.some((r) => matchPath(pathname, r));
    if (isProtected && user?.role !== role) {
      return NextResponse.redirect(new URL("/login", request.url));
    }
  }

  return NextResponse.next();
}

Security Best Practices

1. HttpOnly cookies — tokens can't be accessed by JavaScript (XSS protection)
2. Secure flag — cookies only sent over HTTPS in production
3. SameSite=Lax — CSRF protection for most cases
4. Bcrypt with 12 rounds — password hashing that's intentionally slow
5. Token expiration — 7-day maximum, configurable
6. Soft delete aware — deletedAt: null in all user queries
7. Rate limiting — prevent brute force login attempts
8. Input validation — Zod schema before any database query

Encrypted Secrets

Sensitive configuration is encrypted at rest:

// lib/encryption.ts
import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

const ALGORITHM = "aes-256-gcm";
const KEY = Buffer.from(process.env.JWT_SECRET!, "hex").slice(0, 32);

export function encrypt(text: string): string {
  const iv = randomBytes(16);
  const cipher = createCipheriv(ALGORITHM, KEY, iv);
  const encrypted = Buffer.concat([
    cipher.update(text, "utf8"),
    cipher.final(),
  ]);
  const tag = cipher.getAuthTag();
  return `${iv.toString("hex")}:${encrypted.toString("hex")}:${tag.toString("hex")}`;
}

export function decrypt(encryptedText: string): string {
  const [ivHex, encHex, tagHex] = encryptedText.split(":");
  const decipher = createDecipheriv(
    ALGORITHM,
    KEY,
    Buffer.from(ivHex, "hex")
  );
  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
  return decipher.update(Buffer.from(encHex, "hex")).toString("utf8") +
    decipher.final("utf8");
}

Used for SMTP credentials, PayPal keys, and other secrets stored in the SiteConfig table.

Apply These Patterns

Our Developer Portfolio & SaaS Platform implements all of these authentication patterns. Get custom JWT auth, 4-role RBAC, encrypted secrets, and middleware protection out of the box.

Related reads:

• Next.js 16 Complete Guide — middleware and Server Actions
• Building REST APIs — securing API endpoints
• TypeScript Tips — type-safe authentication

Follow on LinkedIn for security best practices.

Secure by default. Our Developer Portfolio SaaS features custom JWT auth, RBAC, and AES-256-GCM encryption — $299.