Secure Authentication and Authorization with Next.js, Next-auth, and FastAPI Backend using MongoDB Adapter

[Dib5pm]

I am currently working on a project that uses Next.js with next-auth for the frontend and Python FastAPI for the backend. I have been using the Google provider for authentication, and I plan to add a magic link login in the future. I'm utilizing the database strategy with the MongoDB adapter for handling user data.

While I have a good understanding of the frontend implementation, I'm having trouble figuring out the best way to validate the user on the backend.

My current approach is to use the next-auth.session-token from the cookies and send this token to the backend. In the backend, I validate whether the token is legitimate, determine the user associated with the token, and check if the token has expired. To do this, I query the sessions collection in the MongoDB database created by next-auth using the next-auth.session-token and access the user information, including their role.

However, I am concerned about the security of this approach. If the database were to be compromised, an attacker could potentially gain access to all user login tokens and misuse them. This seems very insecure, and I couldn't find much information in the next-auth documentation about this topic.

Another issue I'm facing is that since the next-auth.session-token cookie can only be accessed by the backend, I have to route all requests to the backend from my client through a proxy to add the next-auth.session-token to the request. This doesn't seem like the right way to handle this.

I am wondering if there's a better and more secure way to handle authentication and authorization between my Next.js frontend and FastAPI backend using the MongoDB adapter. Any guidance, resources or best practices for enhancing security and improving the architecture would be greatly appreciated.

My setup in[...nextauth].ts looks like this:

import NextAuth from 'next-auth';
import GoogleProvider from 'next-auth/providers/google';
import clientPromise from '../../../utils/mongodb/mongodb';
import { MongoDBAdapter } from '@next-auth/mongodb-adapter';

export default NextAuth({
  // Configure one or more authentication providers
  providers: [
    GoogleProvider({
      clientId: process.env.GOOGLE_CLIENT_ID as string,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,

      profile(profile) {
        return {
          id: profile.sub,
          name: profile.name,
          googleEmailVerified: profile.email_verified,
          email: profile.email,
          image: profile.picture,
          firstLogin: new Date(),
          role: 'USER',
          locale: profile.locale,
          isSubscribed: false,
        };
      },
    }),
  ],

  session: {
    strategy: 'database',
    maxAge: 7 * 24 * 60 * 60, // 7 days
    updateAge: 30 * 60, // 24 hours
  },

  pages: {
    signIn: '/login',
    signOut: '/',
    error: '/error', // Error code passed in query string as ?error=
    verifyRequest: '/auth/verify-request', // (used for check email message)
    newUser: '/tools/project', 
  },
  callbacks: {
    async session({ session, user }) {
      if (session?.user) {
        session.user.role = user.role;
        session.user.firstLogin = user.firstLogin;
        session.user.locale = user.locale;
        session.user.isSubscribed = user.isSubscribed;
        session.user.googleEmailVerified = user.googleEmailVerified;
        session.user.id = user.id;
      }

      return session;
    },
    async redirect({ url, baseUrl }) {
      return url.startsWith(baseUrl)
        ? Promise.resolve(url)
        : Promise.resolve(baseUrl);
    },
  },

  debug : process.env.NODE_ENV === "development",
  adapter: MongoDBAdapter(clientPromise),
});

If a user logs in it generates three tables in my Mongodb instance:

User, Account and Session

[mariomeissner]

I don't have an answer to your question, but could you show how you achieved this part?

My current approach is to use the next-auth.session-token from the cookies and send this token to the backend. In the backend, I validate whether the token is legitimate, determine the user associated with the token, and check if the token has expired. To do this, I query the sessions collection in the MongoDB database created by next-auth using the next-auth.session-token and access the user information, including their role.

I would love to use it as an implementation reference since I want to do something similar. I've posted a separate discussion entry for my question too (#11738).

[Dib5pm]

Hi, you can send cookies with the request from the frontend. Then, on the backend, you can read the request header and query your database (if you're using a database strategy) to validate whether the user has an active session. However, I decided not to continue with this approach because it felt a bit hacky. Instead, I opted for Supertokens, which was much easier to set up with Next.js and a separate backend.