Authorization for Next.js applications

Integrate Cerbos authorization service with your Next.js application for fine-grained, low-maintenance access controls that scale from startup to enterprise.

Building roles and permissions in Next.js

Next.js is an open-source framework that lets you build server-side rended and static web applications using React. It has features like TypeScript support, smart bundling, route prefetching that make it a powerful tool for developers.

When it’s time to add user access and authorization, Next.js also makes it easy to pull the best solution off the shelf and add it to your application. It supports multiple authentication patterns, so it’s easy to plug in a service like next-auth, Clerk or Auth0 without too much hassle. And integrating Cerbos for authorization couldn’t be simpler.

Advantages of using Cerbos for Next.js roles and permissions

Cleaner code: With Cerbos handling authorization there are no complicated conditional checks to write and maintain your application code.
Fine-grained authorization control: Cerbos gives you the ability to define access control policies for your Next.js applications, based on user roles, attributes and specific contexts.
More reliable compliance and transparency: Cerbos helps you meet regulatory requirements with automated audit logs of every action taken and decision made in regards to user authorization.
Scalability: Cerbos will easily scale with any of your Next.js applications, greatly reducing the maintenance and re-factoring associated with growing a product.

Client SDK Example

if (user.email.includes("@mycompany.com") ||
  (user.company.package === "premium" && user.groups.includes("managers"))
) {
  if(user.region === resource.region) {
    // access allowed
    AuditLog.record("ALLOWED", "edit", user, resource);
  } else {
    // access denied
    AuditLog.record("DENIED", "edit", user, resource);
  }
} else {
  // access denied
  AuditLog.record("DENIED", "edit", user, resource);
}

if (await cerbos.isAllowed({ principal: user, resource, action: "edit" })) {
  // allowed
}

Before

After

How to integrate Cerbos with a Next.js application

Step 1: Define your policies

You can use Cerbos to implement fine-grained and contextual access policies for features, data, and services within your Next.js application. If you signed up to Cerbos Hub there are built-in tools to help you write and test your policies.

You can also create your own policy repository by following the directions in our documentation here: Cerbos Quickstart

Step 2: Sign in to Cerbos Hub (optional)

Signing up to Cerbos Hub is free and makes it easier to work collaboratively on authorization with teammates and centralize authorization management. When you sign up you will be prompted to create an organization and a workspace, to which you will connect a Github repository.

Step 3: Deploy a Policy Decision Point and integrate the Cerbos SDK

Using our container or pre-build binaries, run a Policy Decision Point alongside your application for low-latency authorization checks.

Install the client library to allow your application to interact with the Cerbos Policy Decision Point over gRPC or REST from server-side Next.js handlers.

Step 4: Replace hard-coded authorization with a call to Cerbos

In your API handlers or getServerProps functions, replace any hardcode authorization checks with an SDK call out to a Cerbos policy decision point

Cerbos evaluates every permission request at run time using the most up-to-date data and policies.

Step 5: Iterate on roles and permissions in Cerbos without changing code

When your requirements change, it only takes a few minutes to update your policies in either Cerbos Hub or your local Cerbos instance, and updates are immediately applied without having to change the application code.

More information

Here is a list of resources to help you get started integrating Cerbos with your Next.js application.

Get started

Sign up to Cerbos Hub for free and create your first policy repository. Reach out to us via our Slack Community or set up a one-on-one meeting for support on creating your policy logic or your implementation.

FAQ

How Can Attribute-Based Access Control (ABAC) Be Utilized in Next.js for Dynamic Authorization?

By creating granular access control policies that consider user attributes, resource attributes, and context, developers may implement ABAC by integrating Cerbos with Next.js. In particular, you can:

Send a request from your Next.js middleware or API routes to Cerbos' Policy Decision Point (PDP). This request contains the activity the user attempts to complete, the resources they are accessing, and their attributes (roles, departments, etc.).
When you compare this information to the policies you've specified in the policy language (YAML or JSON), Cerbos determines whether to provide access.
With this method, access control may be dynamic and fine-grained. Permissions can be immediately adjusted within your Next.js application flow based on any change in an attribute or context.

How do you implement access control for static and dynamic pages in Next.js?

Access control with Cerbos can be implemented for static pages in Next.js either at build time or on a per-request basis using getStaticProps or getServerSideProps, respectively. Use client-side fetching to examine Cerbos' PDP or incorporate Cerbos into your API routes for dynamic pages or client-side rendered components. Actions consist of:

Defining user roles and attributes in Cerbos access control policies that dictate which pages and resources must be accessed.
Utilize Next.js functions to query Cerbos with the user's current session information and the resource they want to view when a page is requested.
Cerbos will decide whether to render the page, send the user to an error or login page, or retrieve and dynamically display the content on the client side.

How Do You Implement Role-Based Access Control (RBAC) in Next.js Applications?

Access control is streamlined and secured when RBAC is implemented in Next.js with Cerbos by:

Centralizing Policies: By eliminating dispersed logic throughout the application, Cerbos centralizes access control policies.
Increasing Scalability: Cerbos' scalable approach eliminates the complexity of custom logic management by enabling simple role or permission updates as your application expands.
Cerbos ensures consistency by acting as a single source of truth for access policies. This is important because it allows apps to interact with shared services uniformly.
Dynamic Access Decisions: Cerbos offers dynamic policies considering user context, attributes, and resource specifics, providing flexible control that adjusts to changes. This is in contrast to static roles in conventional systems.
Cutting Complexity: Cerbos drastically cuts boilerplate code and complexity by abstracting access control into declarative policies.

What is Cerbos?

Cerbos is open source, decoupled access control for your application enabling you to implement fine-grained permissions in minutes.

Agile

Define and evolve complex policies without requiring a release cycle

Compliance

Meet your compliance requirements with a full audit trail of policies, permissions, access to resources

Enterprise

Be enterprise ready and meet your customer's organizational requirements with ease

Proactive

Coming soon: SIEM integrations and anomaly detection and recommendations of policy changes

Extend NextJS Roles

Fine grained access controls extending the roles defined in NextJS

Enrich with Context

Request time attribute based authorization enables more contextual access controls

Avoid Token Bloat

Independent authorization logic avoids bloated tokens and workarounds

Why Cerbos?

Simple

Define access policies using human-readable YAML. No need to master a new policy language.

Super-charged Roles

Dynamically derive new roles based on contextual information. Don't be limited to what your IdP provides.

Context-aware

Make use of context such as IP address and time of day to make realtime access decisions

Ultrafast API

Access decisions in milliseconds.

GitOps

Develop, test, and deploy policies just as you do with your source code.

Multiple Environments

Built-in policy versioning to support canary deployments and different environments.

Cloud Native

Containerised deployment as a microservice or a sidecar. REST and gRPC interfaces. Top-notch observability.

Audit Logs

Capture every decision and analyze them later.

Community

Leverage our community for examples and help.

Book a free Policy Workshop to discuss your requirements and get your first policy written by the Cerbos team