tomevault-io Authentication & Token Management
Priority: P0 (CRITICAL)
Use HttpOnly Cookies for token storage. Never use LocalStorage.
Key Rules
- Storage: Use
cookies().set()withhttpOnly: true,secure: true,sameSite: 'lax'.- Reference: Auth Implementation (See "Setting Tokens").
- Access: Read tokens in Server Components via
cookies().get().- Reference: Auth Implementation (See "Reading Tokens").
- Protection: Guard routes in
middleware.tsbefore rendering.- Reference: Auth Implementation (See "Middleware Protection").
Anti-Pattern: LocalStorage
- Security Risk: Vulnerable to XSS.
- Performance Hit: Incompatible with Server Components (RSC). Forces client hydration and causes layout shift.
Converted and distributed by TomeVault — claim your Tome and manage your conversions.