A Lucia auth login page for Next.js

app/login/page.tsx

import { redirect } from "next/navigation";
import { getCurrentSession } from "@/lib/auth-session";
import LoginCard from "./login-card";

export default async function LoginPage() {
  // Already signed in? Skip the form.
  if (await getCurrentSession()) redirect("/dashboard");
  return (
    <main className="grid min-h-dvh place-items-center bg-[#0b0d12] p-4">
      <LoginCard />
    </main>
  );
}

app/login/actions.ts

"use server";
import { verify } from "@node-rs/argon2";
import { redirect } from "next/navigation";
import { db } from "@/lib/db";
import {
  createAuthSession,
  deleteAuthSession,
  deleteSessionCookie,
  getCurrentSession,
  setSessionCookie,
} from "@/lib/auth-session";

export async function signIn(email: string, password: string): Promise<{ error: string | null }> {
  const user = await db.findUserByEmail(email.trim().toLowerCase());
  const ok = user !== null && (await verify(user.passwordHash, password.normalize("NFC")));
  // One message for both cases, so the form doesn't tell anyone which emails have accounts
  if (!user || !ok) return { error: "Wrong email or password." };

  const { token } = await createAuthSession(user.id);
  await setSessionCookie(token);
  return { error: null };
}

export async function signOut() {
  const session = await getCurrentSession();
  if (session) await deleteAuthSession(session.id);
  await deleteSessionCookie();
  redirect("/login");
}

lib/auth-session.ts

import { cookies } from "next/headers";
import { cache } from "react";
import { db } from "./db";

// Adapted from Lucia's code/auth_session.ts (Zero-Clause BSD, lucia-auth.com).
// Same session model: id, userId, secretHash, tokenLastVerifiedAt, createdAt.
export interface AuthSession {
  id: string;
  userId: string;
  secretHash: Uint8Array;
  tokenLastVerifiedAt: Date;
  createdAt: Date;
}

export const SESSION_COOKIE = "auth_session";
export const SESSION_SECONDS = 60 * 60 * 24 * 10; // 10 days, extended while in use

export async function createAuthSession(userId: string) {
  const now = new Date();
  const id = generateRandomId();
  const secret = new Uint8Array(32);
  crypto.getRandomValues(secret);
  const secretHash = new Uint8Array(await crypto.subtle.digest("SHA-256", secret));
  // Lucia's file calls secret.toBase64(), which needs Node 25.
  // Buffer gives the same result on the Node versions Next.js runs on today.
  const token = id + "." + Buffer.from(secret).toString("base64url");
  const session: AuthSession = { id, userId, secretHash, tokenLastVerifiedAt: now, createdAt: now };
  await db.insertAuthSession(session);
  return { session, token };
}

export async function validateAuthSessionToken(token: string): Promise<AuthSession | null> {
  const now = new Date();
  const [id, encodedSecret, ...rest] = token.split(".");
  if (!id || !encodedSecret || rest.length > 0) return null;
  const secret = new Uint8Array(Buffer.from(encodedSecret, "base64url"));
  if (secret.byteLength !== 32) return null;

  const session = await db.getAuthSession(id);
  if (session === null) return null;
  if (now.getTime() - session.tokenLastVerifiedAt.getTime() >= SESSION_SECONDS * 1000) {
    await db.deleteAuthSession(session.id);
    return null;
  }
  const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", secret));
  if (!constantTimeEqual(hash, session.secretHash)) return null;

  // Used again after an hour or more: push the expiry back
  if (now.getTime() - session.tokenLastVerifiedAt.getTime() >= 60 * 60 * 1000) {
    session.tokenLastVerifiedAt = now;
    await db.updateAuthSession(session);
  }
  return session;
}

export async function deleteAuthSession(id: string) {
  await db.deleteAuthSession(id);
}

// One database read per request, however many components ask
export const getCurrentSession = cache(async (): Promise<AuthSession | null> => {
  const token = (await cookies()).get(SESSION_COOKIE)?.value;
  return token ? validateAuthSessionToken(token) : null;
});

// Cookies can only be written from a server action, a route handler or proxy.ts
export async function setSessionCookie(token: string) {
  (await cookies()).set(SESSION_COOKIE, token, {
    path: "/",
    maxAge: SESSION_SECONDS,
    httpOnly: true,
    sameSite: "lax",
    secure: process.env.NODE_ENV === "production",
  });
}

export async function deleteSessionCookie() {
  (await cookies()).delete(SESSION_COOKIE);
}

// 16 random bytes, 5 bits each from an alphabet without l, o, 0 and 1: 80 bits
function generateRandomId(): string {
  const alphabet = "abcdefghijkmnpqrstuvwxyz23456789";
  const bytes = new Uint8Array(16);
  crypto.getRandomValues(bytes);
  let id = "";
  for (const b of bytes) id += alphabet[b >> 3];
  return id;
}

function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {
  if (a.byteLength !== b.byteLength) return false;
  let c = 0;
  for (let i = 0; i < a.byteLength; i++) c |= a[i] ^ b[i];
  return c === 0;
}

lib/db.ts

import type { AuthSession } from "./auth-session";

// Lucia's file leaves the queries to you, and so does this one.
// Swap each body for Drizzle, Prisma or plain SQL on your user and auth_session tables.
export type User = { id: string; email: string; passwordHash: string };

export const db = {
  async findUserByEmail(email: string): Promise<User | null> {
    throw new Error("TODO: select id, email, password_hash from user where email = ?");
  },
  async insertAuthSession(session: AuthSession): Promise<void> {
    throw new Error("TODO: insert into auth_session");
  },
  async getAuthSession(id: string): Promise<AuthSession | null> {
    throw new Error("TODO: select * from auth_session where id = ?");
  },
  async updateAuthSession(session: AuthSession): Promise<void> {
    throw new Error("TODO: update auth_session set token_last_verified_at = ? where id = ?");
  },
  async deleteAuthSession(id: string): Promise<void> {
    throw new Error("TODO: delete from auth_session where id = ?");
  },
};

proxy.ts

import { NextResponse, type NextRequest } from "next/server";
import { SESSION_COOKIE, SESSION_SECONDS } from "@/lib/auth-session";

// Server Components can read cookies but can't write them, so the cookie's
// expiry is pushed back here on page loads. validateAuthSessionToken moves the database row.
export function proxy(request: NextRequest) {
  const response = NextResponse.next();
  const token = request.cookies.get(SESSION_COOKIE)?.value;
  if (request.method === "GET" && token) {
    response.cookies.set(SESSION_COOKIE, token, {
      path: "/",
      maxAge: SESSION_SECONDS,
      httpOnly: true,
      sameSite: "lax",
      secure: process.env.NODE_ENV === "production",
    });
  }
  return response;
}

export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"] };

app/dashboard/page.tsx

import { redirect } from "next/navigation";
import { getCurrentSession } from "@/lib/auth-session";
import { signOut } from "../login/actions";

export default async function Dashboard() {
  const session = await getCurrentSession();
  if (!session) redirect("/login");

  return (
    <main className="p-8">
      <p>Signed in as {session.userId}</p>
      <form action={signOut}>
        <button type="submit">Sign out</button>
      </form>
    </main>
  );
}