boho auth 보호

Simple password protection for Next.js. One dependency, jose.

Installation

npm install bohoauth

Usage

Create a config file:

lib/boho.ts

import { bohoAuth } from "bohoauth";

export const boho = bohoAuth({
  password: process.env.BOHO_PASSWORD,
  secret: process.env.BOHO_SECRET,
  middleware: {
    loginPath: "/login",
    protectedPaths: ["/dashboard"],
    redirectPath: "/dashboard",
  },
});

02
Add the route handlers. This serves POST /api/boho/login, POST /api/boho/logout and GET /api/boho/session.
app/api/boho/[...boho]/route.ts
```
import { boho } from "@/lib/boho";

export const { GET, POST } = boho.handlers;
```
03
Add the middleware. On Next.js 14 and 15, name the file middleware.ts instead.
proxy.ts
```
import { boho } from "@/lib/boho";

export default boho.middleware;
```

Add a login form. A plain HTML form works without any JavaScript.

app/login/page.tsx

<form action="/api/boho/login" method="post">
  <input type="password" name="password" required />
  <button type="submit">Sign in</button>
</form>

To sign out, post a form to /api/boho/logout.

Options

Option	Description
`password`	The password users enter. Defaults to the `BOHO_PASSWORD` env variable.
`secret`	The secret used to sign tokens. Defaults to the `BOHO_SECRET` env variable.
`expiresIn`	How long a login lasts. Defaults to `1h`.
`basePath`	Where the route handlers are mounted. Defaults to `/api/boho`.
`middleware.loginPath`	Where logged-out users are sent. Defaults to `/login`.
`middleware.protectedPaths`	Paths or patterns that require a login.
`middleware.publicPaths`	Exceptions to protectedPaths that stay public.
`middleware.redirectPath`	Where users go after logging in. Defaults to `/`.

Path patterns

protectedPaths and publicPaths accept plain paths, patterns using the same syntax as the Next.js matcher, or regular expressions.

Pattern	Matches
`/dashboard`	/dashboard and everything under it
`/:id`	/abc, but not /abc/def
`/:id/:rest*`	/abc and everything under it
`/blog/:slug*`	/blog, /blog/a, /blog/a/b
`/docs/:path+`	/docs/a, /docs/a/b, but not /docs
`/shop/:category?`	/shop and /shop/shoes

To protect a dynamic route like app/[id]/page.tsx, or everything except a few pages:

lib/boho.ts

// a top-level dynamic route
protectedPaths: ["/:id"],

// everything except a few pages
protectedPaths: ["/"],
publicPaths: ["/about", "/blog/:slug*"],

The login page, the route handlers and Next.js static assets are always allowed, so protecting / never blocks logging in.