Authentication in Next.js 2026 – The Approach I Use Now

September 10, 2026 — NextJS, Authentication, AuthJS, Security — 2 min read

Authentication in Next.js 2026 – The Approach I Use Now

Hey everyone,

Authentication has always been one of the parts that tends to make a project messy. After trying various approaches (NextAuth, Clerk, Auth.js, custom JWT, etc.), I now have an approach that's pretty stable and simple.

Here's what I use in most of my 2026 projects:

1. Auth.js (NextAuth v5) + Database Session

I prefer database sessions over pure JWT, especially for applications that need stronger security (being able to revoke a session).

// auth.ts
import NextAuth from "next-auth";
import { PrismaAdapter } from "@auth/prisma-adapter";
import prisma from "@/lib/prisma";

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    /* Google, Credentials, etc. */
  ],
  session: { strategy: "database" },
});

2. Server-Side Protection

I always protect on the server first:

import { auth } from "@/auth"
import { redirect } from "next/navigation"

export default async function DashboardPage() {
  const session = await auth()
  if (!session) redirect("/login")

  return <div>Welcome {session.user.name}</div>
}

3. Simple Role-Based Access Control (RBAC)

I add a role to the session:

// types
declare module "next-auth" {
  interface Session {
    user: {
      id: string;
      role: "admin" | "user" | "moderator";
    };
  }
}

Then in a server action / page, I check the role before proceeding.

4. Things I Avoid

Storing sensitive data in a client-side cookie without httpOnly
Relying only on client-side protection
Building an auth system from scratch (unless it's truly needed)

5. Alternatives I Also Like

Clerk → when I need something fast with great UI out of the box
Lucia Auth → when I want something more lightweight with full control
Supabase Auth → when I'm already using Supabase

Conclusion

In 2026, I prioritize security + maintainability over excessive features.

Auth.js + database sessions is still my go-to choice for most projects. Simple, flexible, and powerful enough.

A question for you all: What auth solution are you currently using? Auth.js, Clerk, Lucia, or something else?

Share your thoughts in the comments!

— Ady Rahmansyah Software Engineer | Tech Blogger | Coffee Addict