How to Do Server-Side Auth Check in Supabase

1// UNSAFE on the server — reads cached session without verification
2const { data: { session } } = await supabase.auth.getSession()
3// session.user could be spoofed!
4
5// SAFE on the server — verifies JWT with Supabase Auth server
6const { data: { user }, error } = await supabase.auth.getUser()
7// user is verified, or error is returned if JWT is invalid

1// lib/supabase/server.ts (for Next.js App Router)
2import { createServerClient } from '@supabase/ssr'
3import { cookies } from 'next/headers'
4
5export async function createClient() {
6  const cookieStore = await cookies()
7
8  return createServerClient(
9    process.env.NEXT_PUBLIC_SUPABASE_URL!,
10    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
11    {
12      cookies: {
13        getAll() {
14          return cookieStore.getAll()
15        },
16        setAll(cookiesToSet) {
17          try {
18            cookiesToSet.forEach(({ name, value, options }) =>
19              cookieStore.set(name, value, options)
20            )
21          } catch {
22            // setAll may fail in Server Components
23          }
24        },
25      },
26    }
27  )
28}

1// app/dashboard/page.tsx (Next.js Server Component)
2import { createClient } from '@/lib/supabase/server'
3import { redirect } from 'next/navigation'
4
5export default async function DashboardPage() {
6  const supabase = await createClient()
7  const { data: { user }, error } = await supabase.auth.getUser()
8
9  if (error || !user) {
10    redirect('/login')
11  }
12
13  // User is verified — safe to fetch user-specific data
14  const { data: todos } = await supabase
15    .from('todos')
16    .select('*')
17    .eq('user_id', user.id)
18
19  return (
20    <div>
21      <h1>Welcome, {user.email}</h1>
22      <ul>
23        {todos?.map((todo) => (
24          <li key={todo.id}>{todo.title}</li>
25        ))}
26      </ul>
27    </div>
28  )
29}

1// middleware.ts (Next.js root middleware)
2import { createServerClient } from '@supabase/ssr'
3import { NextResponse } from 'next/server'
4import type { NextRequest } from 'next/server'
5
6export async function middleware(request: NextRequest) {
7  let supabaseResponse = NextResponse.next({ request })
8
9  const supabase = createServerClient(
10    process.env.NEXT_PUBLIC_SUPABASE_URL!,
11    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
12    {
13      cookies: {
14        getAll() {
15          return request.cookies.getAll()
16        },
17        setAll(cookiesToSet) {
18          cookiesToSet.forEach(({ name, value, options }) => {
19            request.cookies.set(name, value)
20            supabaseResponse.cookies.set(name, value, options)
21          })
22        },
23      },
24    }
25  )
26
27  const { data: { user } } = await supabase.auth.getUser()
28
29  // Redirect unauthenticated users to login
30  if (!user && request.nextUrl.pathname.startsWith('/dashboard')) {
31    const url = request.nextUrl.clone()
32    url.pathname = '/login'
33    return NextResponse.redirect(url)
34  }
35
36  return supabaseResponse
37}
38
39export const config = {
40  matcher: ['/dashboard/:path*', '/settings/:path*'],
41}

1// app/api/todos/route.ts (Next.js API Route)
2import { createClient } from '@/lib/supabase/server'
3import { NextResponse } from 'next/server'
4
5export async function POST(request: Request) {
6  const supabase = await createClient()
7  const { data: { user }, error } = await supabase.auth.getUser()
8
9  if (error || !user) {
10    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
11  }
12
13  const body = await request.json()
14
15  // RLS ensures user can only insert their own todos
16  const { data, error: insertError } = await supabase
17    .from('todos')
18    .insert({ title: body.title, user_id: user.id })
19    .select()
20    .single()
21
22  if (insertError) {
23    return NextResponse.json({ error: insertError.message }, { status: 400 })
24  }
25
26  return NextResponse.json({ data })
27}