How to build a login flow in Next.js 15 (sessions, cookies, CSRF, and the timing attack nobody talks about)

The article explains a hardened Next.js 15 login flow using session cookies, CSRF protection, hashed session storage, and timing-attack defenses.

A login form posts credentials to an auth endpoint, which verifies passwords and creates a session row in Postgres before setting a cookie for later requests.

Only a SHA-256 hash of the session token is stored, along with session metadata, to reduce replay risk if the database is leaked.

The design also adds CSRF checks and timing-attack mitigation, while avoiding brittle practices like binding sessions to IP addresses.