How to build a login flow in Next.js 15 (sessions, cookies, CSRF, and the timing attack nobody talks about)

This is part 4. Today: login. Form, server endpoint, session cookie, CSRF, and a real look at timing defense. This is the endpoint attackers probe the most, so it is the one we harden the hardest. The flow +-------+ +--------------+ +----------+ |Browser| POST | Next.js | SELECT | Postgres | | | email | /api/auth/ | user by | users | | | password | login | email | | | |----------->| |----------->| | | | | | | | | | | session | And then, on every subsequent request: +-------+ GET /dashboard +----