FrontendAuthentication
Overview
JWT-based authentication with NextAuth.js and Django backend.
HyperSaaS uses NextAuth.js v5 (Auth.js) with a credentials provider that authenticates against the Django backend's Djoser JWT endpoints.
Architecture
Browser Next.js Django
│ │ │
│ email + password │ │
│─────────────────────────►│ POST /auth/jwt/create/ │
│ │──────────────────────────►│
│ │ ◄── {access, refresh} ───│
│ │ │
│ │ GET /auth/users/me/ │
│ │──────────────────────────►│
│ │ ◄── user details ────────│
│ │ │
│ ◄── session cookie ─────│ Store tokens in JWT │
│ │ │
│ API request │ │
│─────────────────────────►│ Authorization: JWT {token}│
│ │──────────────────────────►│Key Components
| Component | Location | Purpose |
|---|---|---|
| NextAuth Config | lib/auth/providers.ts | Credentials provider, JWT callbacks |
| Token Utilities | lib/auth/utils.ts | Validate, refresh, extract tokens |
| Server Session | lib/auth/session.ts | Get current user on server |
| Auth Actions | lib/auth/actions.ts | Login/logout server actions |
| Middleware | middleware.ts | Protect routes |
Auth Pages
| Page | Route | Description |
|---|---|---|
| Login | /login | Email + password form |
| Register | /register | Account creation → email verification |
| Activate | /user-activation/[uid]/[token] | Email verification link |
| Reset Password | /reset-password | Request password reset email |
| Confirm Reset | /confirm-password-reset/[uid]/[token] | Set new password |
| Resend Activation | /resend-activation | Request new activation email |
Session Shape
The NextAuth session stores the user profile and both JWT tokens:
interface Session {
user: {
id: string;
email: string;
name: string;
username: string;
image?: string;
subscription_status?: string;
has_active_subscription?: boolean;
accessToken: string;
refreshToken: string;
accessTokenExpires: number; // Unix timestamp
};
}Token Refresh
Tokens are automatically refreshed 60 seconds before expiry in the NextAuth JWT callback. If refresh fails, the session is invalidated and the user is redirected to login.