How to protect routes in Next.js when auth tokens are stored in HttpOnly cookies?
Summary A Next.js app cannot read HttpOnly cookies directly, so the frontend cannot decide whether a user is authenticated. The correct pattern is to let Next.js Middleware or server components validate the session by forwarding the cookies to your backend and letting the backend confirm whether the token is valid. The browser sends cookies automatically, … Read more