Session management in NextJS - Step-by-Step Execution

Concept Flow - Session management

User sends request

↓

Check for session cookie

Yes / No↓

Validate

↓

Load user data

↓

Send response with session info

This flow shows how Next.js checks for a session cookie, validates or creates a session, and sends a response with session data.

Execution Sample

NextJS

import { cookies } from 'next/headers';

export async function GET() {
  const cookieStore = cookies();
  const session = cookieStore.get('sessionId');
  if (!session) {
    // create session
  }
  return new Response('Session checked');
}

This code checks if a session cookie exists and creates one if missing, then responds.

Execution Table

Step	Action	Session Cookie Present?	Session ID Value	Result
1	Receive GET request	No	null	Check for session cookie
2	Session cookie missing	No	null	Create new session ID
3	Set session cookie	Yes	abc123	Send response with new session
4	Next request received	Yes	abc123	Validate session and load user data
5	Session valid	Yes	abc123	Send response with session info
6	Session expired or invalid	Yes	expired	Create new session and update cookie
7	End	-	-	Session management cycle complete

💡 Session management ends after sending response with valid or new session info.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
session	null	null	abc123	abc123	abc123 or new session id
cookieStore	empty	empty	contains sessionId=abc123	contains sessionId=abc123	contains sessionId=abc123

Key Moments - 2 Insights

Why do we check if the session cookie exists before creating a new one?

Because if a session cookie exists (see step 4 in execution_table), we can reuse it to identify the user. Creating a new session every time would lose user state.

What happens if the session cookie is expired or invalid?

As shown in step 6, the system creates a new session and updates the cookie to keep the user logged in securely.

Visual Quiz - 3 Questions

Look at the execution table, what is the session ID value after step 3?

A null

B abc123

C expired

D undefined

💡 Hint

Check the 'Session ID Value' column in row for step 3.

At which step does the system create a new session because the cookie is missing?

A Step 2

B Step 4

C Step 1

D Step 5

💡 Hint

Look for the step where 'Session Cookie Present?' is 'No' and action is 'Create new session ID'.

If the session cookie is valid, what is the expected result at step 5?

A Reject request

B Create new session and update cookie

C Send response with session info

D Delete session cookie

💡 Hint

Refer to the 'Result' column for step 5 in the execution_table.

Concept Snapshot

Session management in Next.js:
- Check for session cookie on each request
- If missing or invalid, create new session and set cookie
- If valid, load user data from session
- Send response with session info
- Keeps user state across requests securely

Full Transcript

Session management in Next.js involves checking if a session cookie exists when a user sends a request. If the cookie is missing, the system creates a new session ID and sets it as a cookie. If the cookie exists and is valid, the system loads user data associated with that session. If the session is expired or invalid, a new session is created and the cookie updated. This process ensures users stay logged in and their state is maintained securely across requests.

Practice

1. What is the main purpose of session management in Next.js applications?

easy

A. To remember user information between page visits

B. To style components dynamically

C. To optimize image loading

D. To handle API request routing

Solution

1. Step 1: Understand session management concept

   Session management is about keeping track of user data across different pages or visits.

2. Step 2: Identify the main purpose in Next.js

   Next.js uses session management to remember users, so they don't have to log in repeatedly or lose their data.

3. Final Answer:

   To remember user information between page visits -> Option A

4. Quick Check:

   Session management = Remember user info [OK]

Hint: Sessions keep user info across pages and visits [OK]

Common Mistakes:

• Confusing session management with styling or routing
• Thinking sessions optimize images
• Believing sessions handle API routing only

2. Which of the following is the correct way to get the session on the server side in Next.js?

easy

A. const session = useSession();

B. const session = getServerSession();

C. const session = fetchSession();

D. const session = getSessionClient();

Solution

1. Step 1: Recall server-side session retrieval method

   In Next.js, the function getServerSession() is used on the server to get the current session.

2. Step 2: Check each option for correctness

   const session = useSession(); uses useSession(), which is client-side only. Options B and D are not valid Next.js functions.

3. Final Answer:

   const session = getServerSession(); -> Option B

4. Quick Check:

   Server session = getServerSession() [OK]

Hint: Use getServerSession() on server, useSession() on client [OK]

Common Mistakes:

• Using useSession() on the server side
• Assuming fetchSession() is a Next.js function
• Confusing client and server session methods

3. Given this Next.js client component code snippet, what will be the output if the user is not logged in?

import { useSession } from 'next-auth/react';

export default function Profile() {
  const { data: session } = useSession();
  if (!session) return <p>Please log in</p>;
  return <p>Welcome, {session.user.name}</p>;
}

medium

A. <p>Please log in</p>

B. <p>Welcome, undefined</p>

C. Error: session is undefined

D. <p>Welcome, Guest</p>

Solution

1. Step 1: Analyze the session check in the component

   The code checks if session is falsy (not logged in), then returns <p>Please log in</p> immediately.

2. Step 2: Determine output when user is not logged in

   Since the user is not logged in, session is null or undefined, so the component returns <p>Please log in</p>.

3. Final Answer:

   <p>Please log in</p> -> Option A

4. Quick Check:

   Not logged in shows 'Please log in' [OK]

Hint: If no session, component returns 'Please log in' [OK]

Common Mistakes:

• Assuming session.user.name exists when session is null
• Expecting an error instead of conditional return
• Thinking it shows 'Welcome, Guest' by default

4. Identify the error in this Next.js server-side session code:

import { getServerSession } from 'next-auth/next';

export async function getServerSideProps(context) {
  const session = await getServerSession(context);
  if (!session) {
    return { redirect: { destination: '/login', permanent: false } };
  }
  return { props: { user: session.user } };
}

medium

A. Returning props instead of redirect is incorrect

B. Using await without async function

C. Redirect destination should be '/home' not '/login'

D. Missing passing context to getServerSession

Solution

1. Step 1: Check getServerSession usage

   The function getServerSession requires the request context to access cookies and headers, so it needs context.req and context.res or the full context passed.

2. Step 2: Identify missing argument

   The code calls getServerSession() without arguments, which causes it to fail to read session data.

3. Final Answer:

   Missing passing context to getServerSession -> Option D

4. Quick Check:

   getServerSession needs context argument [OK]

Hint: Always pass context to getServerSession on server [OK]

Common Mistakes:

• Forgetting to pass context to getServerSession
• Confusing async/await usage
• Incorrect redirect destination assumptions

5. You want to protect a Next.js page so only logged-in users can access it. Which approach correctly combines server and client session checks?

hard

A. Use getServerSession in the component to check session and redirect if missing.

B. Only use useSession in the component to check if user is logged in and redirect if not.

C. Use getServerSession in getServerSideProps to redirect unauthenticated users, and use useSession in the component to show loading or user info.

D. Use useSession in getServerSideProps to fetch session and redirect unauthenticated users.

Solution

1. Step 1: Understand server-side protection

   Using getServerSession in getServerSideProps allows redirecting users before the page loads if they are not logged in.

2. Step 2: Understand client-side session usage

   Using useSession in the component helps show loading states or user info once the page is loaded.

3. Step 3: Evaluate options

   Use getServerSession in getServerSideProps to redirect unauthenticated users, and use useSession in the component to show loading or user info. correctly combines server-side redirect and client-side session display. The other options misuse server/client functions or locations.

4. Final Answer:

   Use getServerSession in getServerSideProps to redirect unauthenticated users, and use useSession in the component to show loading or user info. -> Option C

5. Quick Check:

   Server redirect + client session hook = Use getServerSession in getServerSideProps to redirect unauthenticated users, and use useSession in the component to show loading or user info. [OK]

Hint: Protect server-side, then show session client-side [OK]

Common Mistakes:

• Trying to use client hooks on server
• Not redirecting unauthenticated users server-side
• Using server functions inside components