Next.js 15 Authentication COMPLETE Guide (+ Best Practices, Pitfalls)

Next.js 15 Authentication COMPLETE Guide: In this video, Wesley explains what should be protected in Next.js, discusses cookies and JWT tokens, compares external authentication solutions like Kinde with DIY approaches, walks through Kinde setup, shows how to protect routes using server components, and covers logout, login, and register links. He explains the differences between layout and page auth checks, middleware versus page checks, and how to protect server actions and route handlers. Wesley highlights pitfalls such as using server actions on unprotected routes, static and dynamic rendering issues, and forgetting authorization when connecting external auth with your own database. He also covers roles and permissions, including an admin role, and shares best practices for a data access layer. Timestamps: 00:00 What should be protected in Next.js? 03:48 Cookies and tokens (JWT) 04:27 Auth solution: External (Kinde) vs Do It Yourself? 06:18 Kinde setup 07:56 Protect routes (server components) 10:09 Logout link 11:17 Login link & Register link 11:52 Layout vs Page (where to do auth check?) 14:05 Middleware vs Page (where to do auth check?) 17:49 Protect server actions 20:25 Pitfall: using server action on unprotected route 21:50 Protect route handlers 22:08 Show user info in header: client-side auth (avatar + email in header) 23:28 Pitfall: static & dynamic rendering (IMPORTANT!) 27:44 Connecting external auth solution with your own database 29:45 Pitfall: forgetting authorization 32:14 Roles & Permissions (admin role) 35:09 Best practice: Data Access Layer (DAL)