·
Last changedVersion:
This version passed the hardening gate. Hardening applied 7 targeted changes and preserved all other text. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 10. Review findings remaining: 8.
None
None
Expand | File | Group | Subtype | Severity | Status |
|---|
No findings available
0 findings
| Task | Reference |
|---|---|
Server vs client auth ( | references/server-vs-client.md |
Configure middleware (public-first vs protected-first) | references/middleware-strategies.md |
Protect Server Actions | references/server-actions.md |
API route auth (401 vs 403) | references/api-routes.md |
Cache auth data (user-scoped caching) | references/caching-auth.md |
| Reference | Impact |
|---|---|
| CRITICAL - |
| HIGH - Public-first vs protected-first, |
| HIGH - Protect mutations |
| HIGH - 401 vs 403 |
| MEDIUM - User-scoped caching |
Server vs Client = different auth APIs:
await auth() from @clerk/nextjs/server (async!)useAuth() hook from @clerk/nextjs (sync)Never mix them. Server Components use server imports, Client Components use hooks.
Key properties from auth():
isAuthenticated — boolean, replaces the !!userId patternsessionStatus — 'active' | 'pending', for detecting incomplete session tasksuserId, orgId, orgSlug, has(), protect() — unchanged<Show>For client-side conditional rendering based on auth state:
| Symptom | Cause | Fix |
|---|---|---|
| Missing |
|
Auth not working on API routes | Missing matcher | Add `'/(api |
Cache returns wrong user's data | Missing userId in key | Include |
Mutations bypass auth | Unprotected Server Action | Check |
Wrong HTTP error code | Confused 401/403 | 401 = not signed in, 403 = no permission |
Get started with chainctlchainctl skill install public/clerk/nextjs-patterns:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/clerk/skills/nextjs-patterns:latest
MIT
.claude-plugin/plugin.json
HARDENING.md
SKILL.md
references/api-routes.md
references/caching-auth.md
references/middleware-strategies.md
references/server-actions.md
references/server-vs-client.md