Skills nextjs-supabase-auth
📦

nextjs-supabase-auth

Content revision r2 High Risk ⚙️ External commands🔑 Env variables

Build Next.js Authentication with Supabase

Authentication across browser, server, middleware, and callback contexts is easy to configure incorrectly. This skill provides focused Supabase Auth patterns for Next.js App Router.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "nextjs-supabase-auth" from https://skillstore.io/skills/sickn33-nextjs-supabase-auth.md and its manifest at https://skillstore.io/api/skills/sickn33-nextjs-supabase-auth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-nextjs-supabase-auth.md Signed manifest GET /api/skills/sickn33-nextjs-supabase-auth/manifest Signed lockfile GET /api/skills/sickn33-nextjs-supabase-auth/lockfile

Test it

Using "nextjs-supabase-auth". Review my dashboard protection, which checks a browser session after the page loads.

Expected outcome:

  • Finding: client-only protection can briefly expose protected content.
  • Recommendation: verify the user on the server and enforce access in middleware.
  • Validation: test direct navigation with expired and missing sessions.

Using "nextjs-supabase-auth". Plan Supabase OAuth for Google in an App Router application.

Expected outcome:

  • Create a provider sign-in action with the deployed callback URL.
  • Exchange the callback code for a session on the server.
  • Validate the return path as a local route before redirecting.
  • Test success, denial, expired code, and malformed return-path cases.

Security Audit

High Risk
v6 • 8/4/2026 Open versioned report

The command-execution alerts are false positives caused by JavaScript template literals, Markdown fences, and inline Markdown. Public Supabase environment variables are expected, but the OAuth callback contains a high-severity open redirect through its unvalidated next parameter.

1
Files scanned
314
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SKILL.md:123-131
Unvalidated OAuth Callback Redirect
The callback concatenates the user-controlled next query value with the site origin. Crafted values can produce an external redirect after authentication and support phishing.
The next value comes directly from URL search parameters and reaches NextResponse.redirect without validation. The data flow is explicit in the example.

Risk Factors

⚙️ External commands (7)
SKILL.md:131 SKILL.md:135 SKILL.md:278-283 SKILL.md:283-291 SKILL.md:291-295 SKILL.md:295-299 SKILL.md:299
🔑 Env variables (14)
SKILL.md:38 SKILL.md:39 SKILL.md:50 SKILL.md:51 SKILL.md:81 SKILL.md:82 SKILL.md:237 SKILL.md:38 SKILL.md:39 SKILL.md:50 SKILL.md:51 SKILL.md:81 SKILL.md:82 SKILL.md:237
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-nextjs-supabase-auth/security.svg)](https://skillstore.io/skills/sickn33-nextjs-supabase-auth?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-nextjs-supabase-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-nextjs-supabase-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-nextjs-supabase-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). nextjs-supabase-auth security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6

BibTeX citation

@techreport{sickn33-sickn33-nextjs-supabase-auth-2026, author = {sickn33}, title = {nextjs-supabase-auth security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "nextjs-supabase-auth security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-08-04" url: "https://skillstore.io/skills/sickn33-nextjs-supabase-auth/audits/6" identifiers: - type: other value: "skillstore:sickn33-nextjs-supabase-auth:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Add Authentication to a New Application

Create browser and server clients, login actions, callback handling, and protected routes for a new App Router project.

Review an Existing Auth Integration

Identify insecure session checks, missing middleware, incorrect clients, weak redirect handling, and absent error handling.

Standardize Team Auth Patterns

Define consistent Supabase Auth conventions for server components, server actions, middleware, and OAuth callbacks.

Try These Prompts

Create the Supabase Clients 
Set up Supabase browser and server clients for my Next.js App Router project. Explain the required public environment variables and cookie handling.
Protect Application Routes 
Add Supabase authentication middleware to protect these routes: [ROUTES]. Refresh sessions and redirect unauthenticated users to [LOGIN_PATH].
Implement an OAuth Flow 
Implement Supabase OAuth for [PROVIDER] in Next.js. Include a callback route, validated local redirects, error handling, and production URL considerations.
Audit a Production Integration 
Audit my Next.js Supabase Auth implementation. Check client boundaries, verified user retrieval, middleware coverage, redirect validation, cookie updates, errors, and cache revalidation.

Best Practices

  • Use getUser for security decisions because it verifies the authentication token.
  • Keep browser and server Supabase clients separate and update cookies through supported server interfaces.
  • Validate callback destinations as local paths before redirecting authenticated users.

Avoid

  • Do not trust getSession alone for server-side authorization checks.
  • Do not expose Supabase service-role keys through public environment variables.
  • Do not concatenate untrusted query values into authentication redirects.

Frequently Asked Questions

Which Next.js architecture does this skill support?
It focuses on the Next.js App Router, including server components, server actions, route handlers, and middleware.
Does the Supabase anonymous key need to remain secret?
No. It is intended for public clients, but row-level security must restrict database access.
Why should authorization checks use getUser?
getUser verifies the token with Supabase and is appropriate for security-sensitive server decisions.
Can this skill configure Google or GitHub OAuth consoles?
It can guide the application flow, but provider console settings and credentials require external configuration.
Does this skill create row-level security policies?
No. Database authorization and row-level security require separate schema design and policy review.
What should be tested before deployment?
Test login, logout, callback failures, expired sessions, cookie refresh, protected routes, and malformed redirect destinations.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/nextjs-supabase-auth

Ref

81e05e636292629114b76cbb3922fbe57672fc02

Maintenance freshness

8/5/2026

Usage

10 downloads · 120 views

File structure

📄 SKILL.md