56 results available
Sign in
Skills directory

nextjs-patterns

clerk

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 7 targeted changes and preserved all other text. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 10. Review findings remaining: 8.


Open before hardening

None

Open after hardening

None


Expand
File
Group
Subtype
Severity
Status

No findings available

0 findings


SKILL.md

Next.js Patterns

What Do You Need?

TaskReference

Server vs client auth (auth() vs hooks)

references/server-vs-client.md

Configure middleware (public-first vs protected-first)

references/middleware-strategies.md

Protect Server Actions

references/server-actions.md

API route auth (401 vs 403)

references/api-routes.md

Cache auth data (user-scoped caching)

references/caching-auth.md

Impact Levels

  • CRITICAL - Breaking bugs, security holes
  • HIGH - Common mistakes
  • MEDIUM - Optimization

References

ReferenceImpact

references/server-vs-client.md

CRITICAL - await auth() vs hooks

references/middleware-strategies.md

HIGH - Public-first vs protected-first, proxy.ts (Next.js <=15: middleware.ts)

references/server-actions.md

HIGH - Protect mutations

references/api-routes.md

HIGH - 401 vs 403

references/caching-auth.md

MEDIUM - User-scoped caching

Mental Model

Server vs Client = different auth APIs:

  • Server: await auth() from @clerk/nextjs/server (async!)
  • Client: useAuth() hook from @clerk/nextjs (sync)

Never mix them. Server Components use server imports, Client Components use hooks.

Key properties from auth():

  • isAuthenticated — boolean, replaces the !!userId pattern
  • sessionStatus — 'active' | 'pending', for detecting incomplete session tasks
  • userId, orgId, orgSlug, has(), protect() — unchanged

Minimal Pattern

// Server Component
import { auth } from '@clerk/nextjs/server'

export default async function Page() {
  const { isAuthenticated, userId } = await auth()  // MUST await!
  if (!isAuthenticated) return <p>Not signed in</p>
  return <p>Hello {userId}</p>
}

Conditional Rendering with <Show>

For client-side conditional rendering based on auth state:

import { Show } from '@clerk/nextjs'

<Show when="signed-in" fallback={<p>Please sign in</p>}>
  <Dashboard />
</Show>

Common Pitfalls

SymptomCauseFix

undefined userId in Server Component

Missing await

await auth() not auth()

Auth not working on API routes

Missing matcher

Add `'/(api

Cache returns wrong user's data

Missing userId in key

Include userId in unstable_cache key

Mutations bypass auth

Unprotected Server Action

Check auth() at start of action

Wrong HTTP error code

Confused 401/403

401 = not signed in, 403 = no permission

Docs

Next.js SDK

Install

Install with chainctl
chainctl skill install public/clerk/nextjs-patterns:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/clerk/skills
Upstream commitc97a3badb579407bce80f64065113b9c7bdeebc3
OCI reference

skills.cgr.dev/public/github.com/clerk/skills/nextjs-patterns:latest

License

MIT

Files

.claude-plugin/plugin.json

HARDENING.md

SKILL.md

references/api-routes.md

references/caching-auth.md

references/middleware-strategies.md

references/server-actions.md

references/server-vs-client.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.