Read server-side identity
Server-rendered pages and server components need the current authenticated user.
Auth.js · Interface
Session
Session is Auth.js’s shared interface for the active logged-in user. It is returned by APIs such as auth, useSession, and getSession, and can be extended with TypeScript module augmentation.
How it works
Session describes the currently authenticated user and is returned by Auth.js session-reading APIs such as auth, useSession, and getSession. Its default user data is intentionally limited; additional fields must be explicitly transferred through the appropriate callbacks.
Syntax
interface Session {}Returns
The active Session object, or null when no session exists.
Key points
- The interface is available through server and client session access APIs, including
auth,useSession, andgetSession. - The default session intentionally exposes only selected user information rather than the complete user record.
- The default user fields are name, email, and image.
- TypeScript module augmentation lets an application add custom properties to the shared Session type.
- After callback configuration, both server-side
auth()and client-sideuseSession()can expose a user ID.
Common mistakes
- With database sessions, the session object itself is still not stored; only selected session-record data is persisted.
Example: Read the current session
import NextAuth from "next-auth"
export const { auth } = NextAuth({
providers: [],
})
export async function getCurrentUser() {
const session = await auth()
return session?.user ?? null
}Call the server-side auth function and read the active user's data when a session exists.
When to use it
Consume client session state
Client React components need reactive access to login state and user data.
Extend the session type
The application needs custom session properties such as a user ID.
Protect authenticated resources
A route or UI must conditionally allow access based on authentication.
Interview questions
QWhat is the Auth.js Session interface used for?
The Session interface represents the active session of the logged-in user. It is returned by auth, useSession, and getSession, and can also be received through the SessionProvider context.
Follow-up: How would you add a user ID? Add it to the JWT in the jwt callback, then copy it to session.user.id in the session callback so client-facing session reads include it.
QWhich user fields are included by default?
By default, Auth.js exposes only a limited subset of user information in the session: name, email, and image. This minimizes the risk of accidentally exposing sensitive user data.
Follow-up: Why is an explicit callback needed for extra fields? Data placed in the token is not automatically exposed to the client; the session callback must return the desired field.
QHow do the session strategies differ?
Auth.js supports JWT and database session strategies. JWT is the default unless a database provider is configured; with JWT, the session is represented by an encrypted token in an HttpOnly cookie, while database sessions store a session record and put its identifier in the cookie.
Follow-up: How can the default be overridden? Configure session.strategy explicitly as either "jwt" or "database".
Related
UserDefaultSessionAuthConfig.sessionauthuseSessiongetSessionSessionProvidersession callback