Next Protected Auth is a JavaScript/TypeScript library designed to simplify the implementation of protected routes and authentication flows within Next.js applications. It provides a set of React components and hooks that abstract common authentication logic for login, logout, and auth callbacks, aiming to reduce boilerplate in Next.js projects. The current stable version is 2.0.450, indicating active maintenance with frequent patch releases, aligning with updates in the Next.js ecosystem. While not a full-fledged authentication provider like Auth.js (formerly NextAuth.js), it focuses specifically on the client-side integration of existing authentication systems with Next.js's routing and middleware for securing routes and managing user sessions. It differentiates itself by providing granular, component-based control over authentication UI and logic hooks.
npm install next-protected-authVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to integrate `next-protected-auth` into a Next.js Pages Router application (`_app.tsx`), using the `useNextAuthProtectedHandler` hook to manage global route protection, public URLs, and token validation logic. It also shows basic usage of the `NextAuthProtectedLogin` component for initiating an authentication flow.
Review the official `next-protected-auth` GitHub releases for a changelog or migration guide. Adapt your code to the new API if necessary, particularly regarding component props or hook signatures.
Regularly update your `next` dependency to the latest secure version. For self-hosted Next.js applications, specifically ensure patches for CVE-2025-29927 (affecting Next.js versions before 12.3.5, 13.5.9, 14.2.25, and 15.2.3) and CVE-2024-51479 (affecting Next.js versions >= 9.5.5, < 14.2.15) are applied.
Stay informed about Next.js release notes and major version upgrade guides. Test your authentication flows thoroughly after any Next.js version upgrade and adapt your integration as needed.
Ensure `useNextAuthProtectedHandler` is called correctly at the root of your application's client-side rendering tree. Carefully define all `publicURLs` that should be accessible without authentication, including your login, auth callback, and any other publicly accessible pages.
Ensure that all calls to `useNextAuthProtectedHandler` and `useNextAuthProtected` are made strictly within the scope of a React functional component or a custom hook.
Install the package using `npm install next-protected-auth` or `yarn add next-protected-auth`. Double-check the import statement for typos.
Verify that you are using named imports for all exports from `next-protected-auth`, for example: `import { useNextAuthProtectedHandler } from 'next-protected-auth';` rather than `import useNextAuthProtectedHandler from 'next-protected-auth';`.