The result of cookies() from next/headers
(Next.js 15+ returns a Promise — pass it directly or pre-awaited, both
work), a NextRequest.cookies object (for middleware.ts / Edge), or any
plain { name: value } map. Adapters with a get(name) method are
detected automatically.
{ clientId, storageKey? }. storageKey defaults to the
library's built-in prefix — only set it when you customized
storageKey in createClient.
The decoded Session or null when the cookie is absent or
malformed. When cookiesStore is a Promise (Next.js 15 cookies()) the
result is a Promise that resolves to the same; otherwise it is returned
synchronously (Next.js ≤14). await works either way, so always await.
The cookie this reads is written by the browser SDK, so it is
not HttpOnly and its content is not verified: anything on the page —
or a request that forges the cookie — can put an arbitrary Session in it.
Use it for convenience only, never as authorization. For server-side auth
in Next.js use @faable/auth-js/nextjs: an HttpOnly, encrypted cookie
the server writes itself, tokens verified against the tenant JWKS, and a
back-channel logout receiver.
Pair this with the cookie storage adapter on the client: when the browser
stores its session under the cookie shared with the server, the same
clientId lets the server reconstruct it. Mirrors how the browser
adapter builds the storage key and reassembles chunked cookies, so no
extra wiring is required.
// app/page.tsx (Next.js 15 — cookies() is async)
import { cookies } from 'next/headers'
import { getSessionFromCookies } from '@faable/auth-js'
export default async function Page() {
const session = await getSessionFromCookies(await cookies(), {
clientId: '<client_id>'
})
if (!session) return <SignIn />
return <Dashboard user={session.user} />
}
// middleware.ts — gate routes at the edge before any HTML is sent
import { NextRequest, NextResponse } from 'next/server'
import { getSessionFromCookies } from '@faable/auth-js'
export async function middleware(req: NextRequest) {
const session = await getSessionFromCookies(req.cookies, {
clientId: '<client_id>'
})
if (!session) return NextResponse.redirect(new URL('/login', req.url))
return NextResponse.next()
}
Reads the persisted session from cookies on the server.
The result of cookies() from next/headers
(Next.js 15+ returns a Promise — pass it directly or pre-awaited, both
work), a NextRequest.cookies object (for middleware.ts / Edge), or any
plain { name: value } map. Adapters with a get(name) method are
detected automatically.
{ clientId, storageKey? }. storageKey defaults to the
library's built-in prefix — only set it when you customized
storageKey in createClient.
The decoded Session or null when the cookie is absent or
malformed. When cookiesStore is a Promise (Next.js 15 cookies()) the
result is a Promise that resolves to the same; otherwise it is returned
synchronously (Next.js ≤14). await works either way, so always await.
The cookie this reads is written by the browser SDK, so it is
not HttpOnly and its content is not verified: anything on the page —
or a request that forges the cookie — can put an arbitrary Session in it.
Use it for convenience only, never as authorization. For server-side auth
in Next.js use @faable/auth-js/nextjs: an HttpOnly, encrypted cookie
the server writes itself, tokens verified against the tenant JWKS, and a
back-channel logout receiver.
Pair this with the cookie storage adapter on the client: when the browser
stores its session under the cookie shared with the server, the same
clientId lets the server reconstruct it. Mirrors how the browser
adapter builds the storage key and reassembles chunked cookies, so no
extra wiring is required.
// app/page.tsx (Next.js 15 — cookies() is async)
import { cookies } from 'next/headers'
import { getSessionFromCookies } from '@faable/auth-js'
export default async function Page() {
const session = await getSessionFromCookies(await cookies(), {
clientId: '<client_id>'
})
if (!session) return <SignIn />
return <Dashboard user={session.user} />
}
// middleware.ts — gate routes at the edge before any HTML is sent
import { NextRequest, NextResponse } from 'next/server'
import { getSessionFromCookies } from '@faable/auth-js'
export async function middleware(req: NextRequest) {
const session = await getSessionFromCookies(req.cookies, {
clientId: '<client_id>'
})
if (!session) return NextResponse.redirect(new URL('/login', req.url))
return NextResponse.next()
}
Reads the persisted session from cookies on the server.