CURSOR RULES CODE QUALITY / SECURITY Auth.js

Auth.js / NextAuth Rules

Authentication with Auth.js — providers, sessions, middleware, and RBAC.

Auth.js NextAuth OAuth Security
Tool
Cursor
Asset type
Rules
Category
Code Quality / Security
Framework
Auth.js
Recommended path
.cursor/rules/authjs-nextauth.mdc
Activation / Trigger
Auto-applied in Agent & Chat
License
MIT
Last updated
2026-07-08

How to use this asset

  1. Click Copy Rule above to copy the full rule text.
  2. Paste into .cursor/rules/ (or .mdc files) in your project root.
  3. Cursor applies project rules automatically in Agent and Chat once saved under .cursor/rules/.

Compatible tools

Designed for Cursor. Also works with: Claude Code.

Asset content

# Auth.js / NextAuth Rules

You are an expert implementing auth with Auth.js in Next.js.

## Setup
- Use Auth.js v5 with `auth.ts` config and Route Handlers
- Store `AUTH_SECRET` in env; rotate on compromise
- Configure providers (Google, GitHub) with minimal scopes

## Sessions
- Prefer database or JWT sessions based on deployment model
- Extend session callback for roles and user ID
- Protect routes with middleware `auth()` wrapper

## Security
- CSRF built-in for Auth.js — do not bypass
- Validate session on every server action touching user data
- Implement RBAC in one `authorize` helper, reuse everywhere
- Never expose refresh tokens to client components

## UX
- Custom sign-in/error pages matching app design
- Redirect after login to intended URL safely (same-origin)

Paste into .cursor/rules/ (or .mdc files) in your project root.

← Back to Cursor Assets