Here is the response

NextResponse [Response] {
  [Symbol(realm)]: { settingsObject: {} },
  [Symbol(state)]: {
    aborted: false,
    rangeRequested: false,
    timingAllowPassed: false,
    requestIncludesCredentials: false,
    type: 'default',
    status: 200,
    timingInfo: null,
    cacheState: '',
    statusText: '',
    headersList: _HeadersList {
      cookies: [Array],
      [Symbol(headers map)]: [Map],
      [Symbol(headers map sorted)]: null
    },
    urlList: []
  },
  [Symbol(headers)]: _HeadersList {
    cookies: [
      'sessionkey=generatedvalue; Path=/login; Expires=Wed, 29 Nov 2023 20:12:41 GMT'
    ],
    [Symbol(headers map)]: Map(2) {
      'x-middleware-next' => [Object],
      'set-cookie' => [Object]
    },
    [Symbol(headers map sorted)]: null
  },
  [Symbol(internal response)]: {
    cookies: ResponseCookies { _parsed: [Map], _headers: [_HeadersList] },
    url: undefined
  }

1.I can see that the response does contain my cookies but I can see it in the postman cookies tab

2. Also how do i access it in the client side and store it

would be great to know as

If the client automatically saves it I can use it to send the cookies each time my user shifts from one segment route to another and see if the session hasnt expired

But I am not able to see the cookies in the postman tab

when I want to get cookies I use this library: https://www.npmjs.com/package/cookies-next

yes, you can do that inside your middleware

Amazing typescript enabled ?

great! but I would also be sharing hte cookie back and forth to check if it hasnt expired right

with the database

now that I type I also mention the expire field with it , does that mean it gets deleted once the expiry is reached ?

yes, you can also do that inside the middleware

do which part ?

this one: https://nextjs-forum.com/post/1179515912471195678#message-1179517213426860032

Check if the cookie has expired in middleware

interesting

thanks any clue why cant I see the cookie in postman tab

you don't need to check that. If they expired, they won't be send from client to server

gotcha. But I would also be storing it in the db

But are you sure the above code is sending the cookies alogn with the custom response I have

Hi I dont see the cookies in my brower set

you can see them inside your cookies tab

if you ask for them, yeah

Ya its not there

wdym ask for them ?

This is hte code

where I get the response

it seems like a login page 🤔

yes its a login page

this might help

put everythign at one place

do I miss something or why do you need cookies there? 🤔

*clientside

I am creating a cookie in the server side

And storing it in clients browser

Then using that I can do two things use it in middleware

And also verify that value to the database value to match that the user is valid and has permission to the page

yea. But why in while logging in? You don't need them there clientside. You just set them to the client. Then whenever you navigate (the middleware will be executes), you are able to get the cookies through the request. You can verify it with the database and easy auth

correct but while my user login's I want to set the cookie so it will have an expiry an value that will also be stored in the db

Whats the best way to do this ?

then you are doing it right. Create a api route and return the token as cookie. Then create a middleware, that verify this token on each request for protected routes

token ?

I created this as my api route

import { NextRequest, NextResponse } from "next/server";
import { compareSync } from "bcrypt-ts";
import { USERPROFILE } from "@/app/types/profile.type";

export async function GET(request:NextRequest){
    await console.log("Get", request);
    return NextResponse.json({
        "message":"Verified"
    });
}

export async function POST(request:NextRequest){
    const body:USERPROFILE = await request.json();
    // const body = await request.text();
    console.log(body.password?.password);
    const hash = "value"
    // const result:boolean = compareSync(body.password?.password!,hash)
    const result = true 
    if(result === true){
        let response = NextResponse.next();
        response.cookies.set("sessionkey","generatedvalue",{
            expires:Date.now() + 100000
        })
        console.log(response)
        return  response
    }
    else{
        return NextResponse.json({error:"Error logging"},{status:400})
    }

    
   
}

this is hte code

NextResponse.next() was used in a app route handler, this is not supported. See here for more info: https://nextjs.org/docs/messages/next-response-next-in-app-route-handler but I get this error

yea token

const token = await jwt.sign(tokenData, process.env.TOKEN_SECRET!, {expiresIn: "1d"}) something like this you mean right ?

the token is not just a random generated value. It's basically the key to autorize every request from the user

but isnt jwt different to cookies

got it I was able to get the cookie

but I want to understand now the difference between using jwt and nornmally setting up the cookie

able to get it even in postman

Thanks for your help

exactly that should be the right behavior ^^

a normal cookie is just a little thing that safe some data in the client browser. A jwt is a token, which can be used to valide it and to grant different auth functionality

cookies, even with httpOnly can still be hijacked and their content read and changed.
JWTs however, are signed therefore it can be guaranteed that it can't be tampered.

Oh okay when you say signed , what do you mean by that ? Like I create a token I use this jwttokenlibrary and sign it what does that mean and why is it impossible for that too be manipulated

all JWT are signed by default, its how jwt works fundamentally. if you edit the jwt, it becomes invalid.
signing is the process of taking a payload and a hashing algorithm to make it so that its impossible to be manipulated

jwt can be verified (using a hashing algorithm) and be decoded (since its only base64 encoded).
if the decoded part is changed, then it will be different from the signage therefore marking it as invalid.

https://discord.com/channels/752553802359505017/1172435746674720798 see here for a visualized diagram on how JWT are produced

Ohhh gotcha . So if we sign it it’s basically hashing it with the content . And would you suggest me to store the hash in the DB in order to verify if hash ? Or store the actual value of token and hash both to compare ?

JWT means that the state is stored in the client as opposed in the database

therefore, you shouldnt store any user state in the database by default (unless you want to implement extra functionality)

JWT are hashed using a secret key that you use to encode all JWT

Yaa but I have to verify the authorisation of the user.

the hash are already part of the JWT, so just send the JWT to the user's cookie using httpOnly (or just as plain text if you want xD)

but better to store in cookie using httpOnly to better protect against csrf (not completely but it helps)

Okay so you have any good resources as in a yt video explaining this I am new to cookies and jwt so was practising creating cookies yesterday . And now I want to try using jwt and see how the flow is

I honestly dont have good resources beside searching up in google and youtube, maybe i need to cite my sources on any article i made like https://discord.com/channels/752553802359505017/1172435746674720798 this one lol

https://jwt.io/introduction obviously, this is a good start

and i use https://github.com/panva/jose to encode and decode the jwts

Yaa checking it out. Not great with visual text haha . Still thanks a lot have saved it . Will work like a charm each time I need to memorise it

So when you sign it it’s hashed and then we need to encode and decode it ?

If it’s hashed there is no way to get the token data back if I am not wrong

yes theres 2 part

theres the base64 encoded part
and the hashed part based on the first part

just see the diagram i made in that link, maybe you can ask question there instead

Sure will do it thanks so cookies was an older way basically ?

And jwt is the more secure and safer way

JWT is the content of the cookie
Cookie is the mean to store stuff in browser

its still used to store JWT :v

Storing Session in database was an older, still currently used, way, to be more precise

JWT is the newer one

its always JWT versus DB Session (and a combination of both to combine both of the benefit)

Oh this makes sense .

Thanks a lot it makes more sense. Now , obviously I will have queries once I start creating it will hit you up.

yeah, feel free to ask me in this discord/create new help-forum

I really want to nail down this part .

Thanks a lot @aardani