Keep sessions in httpOnly cookies and validate them on the server (Server Components and Route Handlers). Use middleware mainly for routing/redirects, but still enforce auth in server code. Avoid relying only on client checks, and be careful with static rendering when content depends on the user.
Expanding on the short answer — what usually matters in practice:
A tiny example (an explanation template):
// Example: discuss trade-offs for "next.js-app-router-auth:-how-do-you-keep-it-secu"
function explain() {
// Start from the core idea:
// Keep sessions in httpOnly cookies and validate them on the server (Server Components and R
}