Protect authenticated pages
Require a signed-in session before allowing a page request.
Auth.js · Function
authorized callback
The authorized callback controls access when Auth.js Middleware evaluates a request. Return an authorization decision for normal flow, or a NextResponse for custom redirects and responses.
How it works
The authorized callback runs when Middleware needs to decide whether a request may proceed. It receives the current authentication state and request, and can return a boolean or a custom NextResponse to allow, deny, redirect, or otherwise handle the request.
Syntax
authorized: (params) => anyParameters
| Name | Type | Description |
|---|---|---|
params.auth | null | Session | The authenticated user or token, if available; otherwise null. |
params.request | NextRequest | The incoming request to evaluate. |
Returns
any; commonly a boolean authorization decision or a NextResponse for custom handling.
Key points
- Auth.js calls this callback from Middleware when it must determine whether a request is authorized.
- The callback is configured as
callbacks.authorizedand receives one parameter object. - The
requestparameter identifies the incoming request whose access is being evaluated. - In the Next.js integration, this callback is the mechanism used to perform request authentication.
Common mistakes
- A boolean is not the only option: return a NextResponse when the request needs a custom response, such as a JSON error or redirect.
- The
authvalue may be null, so authorization logic must handle unauthenticated requests safely.
Example: Require authentication
import NextAuth from "next-auth"
export const { auth, handlers } = NextAuth({
callbacks: {
authorized: async ({ auth }) => {
return !!auth
},
},
})Allows requests from authenticated users and rejects unauthenticated ones.
When to use it
Implement request-aware policies
Inspect HTTP methods or request URLs to apply different access rules.
Customize API denial responses
Return a JSON error with a chosen status for unauthorized API calls.
Interview questions
QWhen does the authorized callback run, and what can it return?
The authorized callback is invoked when Middleware must authorize a request. It receives auth and request; returning a truthy authorization result permits the request, while a custom NextResponse can implement explicit handling.
Follow-up: How would you return an API error instead of redirecting? Return NextResponse.json(...) with an appropriate HTTP status from the callback.
QHow do you protect a route for signed-in users?
Use the auth parameter to inspect the authenticated user or token. For a simple protected route, return whether auth exists; for more specific rules, inspect its properties before deciding.
Follow-up: How can the request affect authorization? Read method, URL, or other request data from request, then return a boolean or custom response based on those values.
QWhat parameters are available to authorized?
The callback receives a parameter object containing auth and request. auth represents the current authenticated user or token, while request is the Next.js request being authorized.
Follow-up: What is a useful method-specific policy? Permit a valid token for a POST request and return a 401 JSON response when validation fails.
Related
callbacksMiddlewareNextResponseSessionNextRequest