Full-Stack Secure App with Auth0, Next.js (+ NextAuth), Spring Boot and PostgreSQL
Frontend: Next.js using next-auth to handle authentication with Auth0 (sign-in, session, tokens). Frontend calls backend APIs with access tokens.
Auth provider: Auth0 — manage Applications (client credentials for machine-to-machine or OIDC for user login), create an API (resource server) to issue access tokens (set audience).
Backend: Spring Boot as an OAuth2 Resource Server (validates access tokens from Auth0). Expose REST endpoints, enforce scopes/roles.
Database: PostgreSQL for persistent data (users, roles, app data). Use migrations (Flyway or Liquibase).
Flow: User logs in via frontend → Auth0 issues ID & Access tokens → NextAuth stores session and sends access token to Spring Boot for protected requests → Spring verifies token signature and claims.
https://trinhvo.hashnode.dev