Building RBAC Session Auditor: Hardening Next.js Authentication with Edge Middleware and Redis

Client-side route protections are a false sense of security. Anything that runs in the browser can be viewed, altered or circumvented.

When developing modern web applications with Next.js you often need to make decisions for user authentication and authorisation. To do this securely and avoid many common access control issues I created RBAC Session Auditor.

• Live Demo: https://auth.afthyir.co.uk/
• Source Code: https://github.com/afthyir/rbac-session-auditor

About RBAC Session Auditor

What is RBAC Session Auditor is a Role Based Access Control (RBAC) system for Next.js that is designed with security in mind. It ensures every request is validated against:

• An active Supabase login
• A Redis session whitelist.

If a request is not valid or doesn't have the correct permissions it will be instantly blocked and logged to a security audit.

Security Architecture

Role Enforcement in Edge Middleware There are three different roles set up for users in the application. These are enforced in Next.js Edge Middleware.

By enforcing these permissions at the edge, we can: Block any unauthorised requests before they can be processed in SSR or API. No way to manipulate roles using developer tools in the browser.

Instant Session Revocation

A common issue with stateless tokens (such as JWTs) is that once they are issued, they are valid until they expire. This means that if an account has been compromised or a users access needs to be revoked instantly, we can't wait for them to expire.

To combat this, RBAC Session Auditor requires that in addition to having a valid Supabase login, all sessions must also be on a Redis session whitelist. By removing a session ID from Redis, we can instantly revoke access to the application.

Fix Common Access Control Issues

Along with basic authentication, this project also helps to eliminate many high risk authorisation issues: BOLA (Broken Object Level Authorisation) - Prevents users from viewing or altering another user's resources by guessing or incrementing object IDs. Fail Closed - If there is an error, timeout or unexpected result when verifying, the request will be denied. Admin Routes - Any sensitive admin routes are completely separate to the client.

Security Audit Logging

To help with investigating any incidents, any denied access attempts will be automatically logged. This will include: Who made the request What route/resource they were trying to access When the request was made.

Tech Stack

• Next.js (App Router & Edge Middleware)
• TypeScript
• Tailwind CSS
• Supabase (Authentication)
• Redis (Session Store & Whitelist)

Try it out!

You can try out the role enforcement, session revocation and audit logging. Or take a look at the code in the repository:

• Live Demo: https://auth.afthyir.co.uk/
• Source Code: https://github.com/afthyir/rbac-session-auditor

Created by: Afthy Irshath (@afthyir)