Read authenticated server state
Server-rendered pages and server components need the signed-in user's identity or metadata.
Auth.js · Pipe
session
Retrieve the authenticated user's session in server or client code. Auth.js uses auth() on the server and useSession() on the client, with SessionProvider required for client-side access.
How it works
Auth.js exposes the current session through server-side auth() or client-side useSession(). On the client, useSession() must be rendered beneath SessionProvider; on the server, auth() returns the session object when the user is authenticated and a falsy value otherwise.
Syntax
const session = await auth()
const { data: session } = useSession()Returns
The current session object when an authenticated session exists; otherwise null or another falsy result, depending on the integration.
Key points
- Server code reads the current session with the auth function exported from the Auth.js configuration.
- Client components can retrieve session data with useSession together with SessionProvider.
- Pages Router components can receive a session obtained by the page and passed through component props.
- In SvelteKit-style routes, the session is available from event.sharedMap, while clients use useSession().
Common mistakes
- Client-side useSession() requires SessionProvider around the consuming component.
- Do not assume custom session fields are stored in the database; database sessions persist the session record, not the complete session object.
Example: Read the current server session
import NextAuth from "next-auth"
export const { auth } = NextAuth({
providers: [],
})
export async function getCurrentUser() {
const session = await auth()
return session?.user ?? null
}Call the exported auth function on the server and use the returned session when it exists.
When to use it
Render client-specific authentication UI
Interactive client components need to update their UI based on sign-in state.
Gate protected resources
A route or page must decide whether to continue, redirect, or reject an unauthenticated request.
Interview questions
QHow do you read the current session on the server?
On the server, use the auth function returned from NextAuth and exported from the Auth.js configuration. It provides the current session, which can then be checked before rendering protected content.
Follow-up: How would you read it in a client component? Use useSession(), but ensure SessionProvider wraps the component tree.
QWhat is required to use useSession() in a client component?
useSession() is the client-side session hook. It should be used beneath SessionProvider, which supplies session state to descendant components.
Follow-up: What should a protected client view do while the session is unresolved? Handle the loading state before deciding whether to render authenticated or unauthenticated content.
QWhat does a session lookup return when no user is signed in?
The session endpoint returns the user's session when one exists and null otherwise. Session checks can therefore distinguish an authenticated request from one without an active session.
Follow-up: How can the result be used for route protection? Redirect or return an unauthenticated response when no valid session is present.
Related
auth()useSession()SessionProviderNextAuth()event.sharedMap.get("session")