So, now that we initialized Lucia, we can
add a new function to this auth.js file, a
function which I'll export and which
should be async.
And I'll name this function
createAuthSession.
And this function should do what the
name suggests.
For a given user, it should create and
store a new session in that sessions
database table and it should then set
such a cookie that's attached to the
outgoing request.
Now therefore here, I expect to get the
ID of the user to whom the session
belongs as an input.
We could also use the email, but I prefer
to use the user ID.
And we can then use this Lucia object to
create a new session.
And under the hood, this will create a
new entry in that sessions database
table and it will create a new unique
session ID that belongs to that session.
Now createSession then needs that user
ID.
So I'll pass that as a first argument to
createSession.
And it also takes a configuration object
or some extra attributes we can store in
that session, some extra data we can
attach to that session here.
But I don't want any extra data, so I'll set
this to an empty object.
Now this will actually give us a promise,
so I'll await this operation.
And as a result, we get back a new
session object.
Now we can also get a session cookie
that's in the end created by Lucia, or to
be precise, we can get the data that
should be set on a session cookie by
Lucia by calling
Lucia.createSessionCookie.
And this function now wants the session
ID as an input.
We get that from our session, so from
this session object here, and then there
we have an ID property.
So this will then give us an object that
holds all the data that should be set on
that session cookie.
To now set that cookie on the outgoing
response in a Next.js app, we can use a
special cookies function which is
actually provided by Next.js and which
should be imported from next slash
headers.
That is a function that you can call
anywhere in your Next.js code to access
the cookie that belongs to the outgoing
response.
So to set new cookies on that response,
for example.
So here I'm calling cookies in
createAuthSession, though it's worth
mentioning that if you're using Next.js
version 15 or higher, you actually have to
await this call.
If you're using Next.js version 14 or lower,
and I initially recorded this section with
Next.js 14, you actually don't need a wait.
That's why you won't see a wait in this
video because I recorded it with Next.js
14.
But if you're using Next.js 15 or higher,
you will need to add a wait here.
And then on the result of awaiting this
call to cookies, you can call get, set, and
so on to interact with the cookies of the
request that is about to be sent back to
the client.
If you're using Next.js 14, you would
directly call get or set on cookies like
this.
And actually, when using Next.js 15, you
can also use this approach because
when using Next.js 15, cookies actually
supports both awaiting it or not
awaiting it.
But in the future, in future major Next.js
versions, you'll always have to call await.
So whenever you see me use cookies
throughout this course, you should
await it and then call set or get or
whatever I'm doing on the result of
awaiting this.
And here I'll call set and set then actually
takes multiple arguments, multiple
values that will be set on a cookie.
And the great thing about Lucia is that
we can now use that session cookie
object we got here and use the name
and then also session cookie value and
session cookie attributes.
And that data is already in a format
that's accepted by this set function to
set a new cookie with a given value.
name with specific values, the session ID
in the end and some attributes that
configure the cookie.
For example, that secure setting which
we set up here and some other things as
well.
So that's how we add that cookie that is
in the end created or for which the data
is in the end created by Lucia to the
outgoing response just by calling this
cookies function and using the set
method on the returned object and this
cookies function as mentioned is
provided by Next.js.
So that's how we create such a session,
Lucia will automatically store it in a
database and how we then add that
session information or that session ID
with help of a cookie to the outgoing
response and the browser of the user
who did try to log in will automatically
store that cookie.
And therefore we now as a next step
need to call createAuthSession in our
code whenever we want to initialize a
new authentication session.