Sessions and current user

Veap auth stores sessions through the configured database-backed repository. The package documents hashed session tokens, expiry, and sliding-window extension; applications should still verify cookie flags and session behavior for their own Next.js setup.

Server-side session checks#

Use the server entry point and session/auth services in server-only code. Do not import session repositories or database models into client components.

import "server-only";
import { getCurrentSession } from "@veap/auth/server";

export async function requireSession() {
  const session = await getCurrentSession();
  if (!session) {
    throw new Error("Unauthenticated");
  }
  return session;
}

Confirm the return shape of getCurrentSession() in the installed declaration; this snippet illustrates the server-only boundary and must be adapted to the exact public type.

Session lifecycle checklist#

• Expire sessions on the server and invalidate them on sign-out.
• Use secure, HTTP-only cookies and an appropriate SameSite policy in the integration layer.
• Rotate session identifiers after authentication or privilege changes.
• Revoke sessions when passwords change or an account is disabled, according to your policy.
• Avoid logging session identifiers or raw tokens.
• Test concurrent requests and session expiry using the actual deployment runtime.

Client session state#

The package provides AuthProvider and useUser from its client entry point. Treat client state as a presentation convenience, not an authorization source. Every privileged server operation must verify the current session and permission independently.