nextjs-ssr-laravel-kit

nextjs-ssr-laravel-kit is a free open-source starter kit that gives a Next.js Pages Router frontend server-side authentication against a Laravel Sanctum token-based API, replacing next-auth with a simpler custom flow. The repository ships both the Next.js app and a Laravel backend under the /laravel directory, plus Docker Compose for one-command startup.

What is nextjs-ssr-laravel-kit?

nextjs-ssr-laravel-kit is a starter kit that combines a Next.js frontend with a Laravel Sanctum backend to deliver stateless, server-side authentication. It takes a Laravel API as its backend dependency and produces a Next.js application with login, registration, email verification, password reset, and protected pages. It runs on Next.js Pages Router with API Routes and uses Axios for HTTP requests. The project is maintained by CODE-AXION on GitHub.

Key Features

• Stateless SSR Authentication — Server-side authentication via a getServerSideProps wrapper named withAuth.js that checks protected routes, guest routes, and email verification before rendering.
• Signed Double Submit CSRF Protection — A withValidation.js wrapper validates CSRF tokens on Next.js API routes, following OWASP guidelines.
• HttpOnly Cookie Tokens — Access and refresh tokens are stored in HttpOnly cookies to reduce XSS exposure.
• Automatic Token Refresh — Axios interceptors detect an expired access token and transparently call the Laravel refresh-token endpoint; default expiry is 1 day for access and 7 days for refresh tokens.
• Route Service Provider — A central config file lists protected routes, guest routes, redirect destinations, and Laravel auth endpoints so middleware behavior is easy to edit.
• Reusable Authorization Helpers — Includes a hasPermission helper (commented out) to gate actions by user permissions.
• Docker Support — A docker-compose setup launches both services with a single docker compose up command.
• Security Config via Environment — Requires API_URL, FRONTEND_URL, NEXT_BACKEND_URL, and CSRF_SECRET_KEY; omitting CSRF_SECRET_KEY crashes the app to force explicit setup.

Who is it for?

• Laravel developers who want a Next.js frontend without hand-writing cookies, CSRF, and refresh token logic.
• Developers frustrated with next-auth for refresh-token management and cookie expiration, who prefer direct axios control.
• Teams building SSR dashboards that need protected pages, guest-only pages, and email-verification redirects mirroring Laravel Breeze behavior.

What can you do with it?

• Add authentication to a Next.js app quickly by configuring the .env.local file and copying the middleware wrappers.
• Protect API routes by importing createAxiosInstance to call Laravel endpoints with automatic token refresh.
• Define route rules through the Route Service Provider to control what unauthenticated and authenticated users see.

How does this starter kit work?

The Next.js backend acts as a proxy to the Laravel API. Pages that need a logged-in user call withAuth as a getServerSideProps wrapper, which fetches user data from the Laravel user endpoint and applies route checks. Next.js API routes that mutate data use withValidation to verify CSRF tokens. For authenticated API calls, developers use createAxiosInstance which attaches the access-token cookie and refreshes it via axios interceptors when expired; public endpoints can be reached with a plain axios call to the NEXT_BACKEND_URL.

FAQ

Do I need Laravel Sanctum?

Yes. This starter kit is designed specifically for Laravel Sanctum in token-based (not session) mode. The README says to use the Sanctum package from the repository instead of Laravel Breeze API because Breeze uses sessions.

What happens if I do not set CSRF_SECRET_KEY?

The application will crash. The README states the key is required and that a random value must be added to .env.local to run the frontend.

What are the default token expiration times?

Access tokens expire after 1 day and refresh tokens after 7 days by default. The expiration values are set in the Laravel config/sanctum.php file, and the README warns to always specify expiration in seconds.

Does this use next-auth?

No. The author tried next-auth but found refresh-token handling and cookie expiration too complex, so this kit implements a custom auth flow with axios interceptors and HttpOnly cookies.

Can I run the whole stack with Docker?

Yes. The repository includes a docker-compose file. Cloning the repo and running docker compose up starts both the Laravel backend and the Next.js frontend, accessible at http://localhost:3000.