server side cookies

src/app/api/account/route.ts

@@ -30,14 +30,22 @@ export async function POST(req: NextRequest) {
 
     await database.users.insertOne({ email, password, name, platforms: {} });
 
-    const sessionId = (await database.sessions.insertOne({ user: email }))
+    const sessionId = await database.sessions.insertOne({ user: email });
-        .insertedId;
 
-    return NextResponse.json(
+    const response = NextResponse.json(
         {
             message: 'ok',
-            sessionId,
         },
         { status: 200 }
     );
+
+    response.cookies.set('session_id', sessionId.toString(), {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'strict',
+        path: '/',
+        maxAge: 60 * 60 * 24, // 1 day
+    });
+
+    return response;
 }

src/app/api/session/route.ts

@@ -53,7 +53,7 @@ export async function GET(req: NextRequest) {
 export async function POST(req: NextRequest) {
     const { email, password } = await req.json();
 
-    if (typeof email !== 'string' || typeof password !== 'string')
+    if (typeof email !== 'string' || typeof password !== 'string') {
         return NextResponse.json(
             {
                 message:
@@ -61,36 +61,39 @@ export async function POST(req: NextRequest) {
             },
             { status: 400 }
         );
+    }
 
     const user = await database.users.findOne({ email });
 
-    if (!user)
+    if (!user || user.password !== password) {
         return NextResponse.json(
             {
-                message: 'Email does not exist',
+                message: 'Invalid email or password',
             },
             { status: 401 }
         );
+    }
 
-    if (user.password !== password)
+    const sessionId = new ObjectId();
-        return NextResponse.json(
+    await database.sessions.insertOne({
-            {
+        _id: sessionId,
-                message: 'Invalid password',
+        user: user._id.toString(),
-            },
+    });
-            { status: 401 }
-        );
 
-    const _id = new ObjectId();
+    const response = NextResponse.json(
-
-    database.sessions
-        .insertOne({ _id, user: user._id.toString() })
-        .then((res) => {});
-
-    return NextResponse.json(
         {
             message: 'ok',
-            sessionId: _id.toString(),
         },
         { status: 200 }
     );
+
+    response.cookies.set('session_id', sessionId.toString(), {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'strict',
+        path: '/',
+        maxAge: 60 * 60 * 24, // 1 day
+    });
+
+    return response;
 }

src/app/login/page.tsx

@@ -7,7 +7,6 @@ import { useToast } from '@/hooks/use-toast';
 import axios from 'axios';
 import Link from 'next/link';
 import { useState } from 'react';
-import cookies from 'js-cookie';
 import { useRouter } from 'next/navigation';
 
 export default function Login() {
@@ -25,8 +24,6 @@ export default function Login() {
                 })
             ).data;
 
-            cookies.set('session_id', sessionId);
-
             router.replace('/dashboard');
         } catch (err: any) {
             toast({

src/app/signup/page.tsx

@@ -52,7 +52,6 @@ export default function SignUp() {
                                     password,
                                 })
                                 .then(async (response) => {
-                                    document.cookie = `session_id=${response.data.sessionId}`;
                                     router.push('/dashboard');
                                 })
                                 .catch((err) => {