Authentication
A shop ledger page, 1899. Every line adds up.
How to Add Authentication to an Existing Next.js App
Add authentication to an existing Next.js App Router project without treating a login screen as the security boundary.
3 min read
JWTs Need No Database Lookup? Revocation, Logout, and Why Only Half True
JWTs avoid a lookup on every request only until you need logout or revocation. Learn denylists, token versioning, short TTLs, and introspection tradeoffs.
4 min read
Roll Your Own Auth or Use a Provider? A Solo Developer Decision Guide
A practical guide for solo developers deciding between building authentication themselves and using a provider, including what you must get right either way.
4 min read
Access and Refresh Tokens: Where to Store Them in a Browser App
Decide where to keep access and refresh tokens in a browser app, using HttpOnly SameSite cookies, short-lived access tokens, rotation, and CSRF protection.
4 min read
JWT vs Session Cookies: How to Choose for a Web App
Compare JWTs and server-side session cookies on revocation, scaling, and complexity, and learn which one is the safer default for a typical browser-based web app.
4 min read