Docs: Authentication page states encrypted sessions but the examples are signed instead, which is misleading

[andytson]

What is the documentation issue?

The documentation at https://github.com/vercel/next.js/blob/canary/docs/02-app/01-building-your-application/09-authentication/index.mdx#2-encrypting-and-decrypting-sessions states encryption of sessions, but the example's session data is not encrypted.

Instead it is signed with a signature, which is good enough for some purposes but is misleading when discussing "encrypted" sessions.

Either this should be renamed and/or a specific encrypted sessions example also to be added (with authentication tags). The latter can be done for example with crypto or crypto.subtle ciphers

Is there any context that might help us understand?

Encrypted sessions would use an encryption of the data (some crypto algorithms support verification as well, but some don't), hiding the data from the user, whereas signed sessions allow verification of tampering only.

Does the docs page already exist? Please link to it.

https://nextjs.org/docs/app/building-your-application/authentication

[samcx]

@andytson Not a security expert myself—is there an example you could provide to showcases an encrypted session?

A is welcome as well!