Session tokens stored in localStorage in Next.js

Keep the session on the server. Set an HttpOnly, Secure, SameSite=Strict cookie from your auth route or from a backend-for-frontend. OWASP prefers Strict for session cookies. Lax permits top-level cross-site navigations that use safe HTTP methods. Use Lax only when a top-level navigation has to send the cookie, and treat SameSite as one CSRF control, the way MDN describes it, not as the whole defense.

Read the session inside Server Components, Route Handlers, and Server Actions through your auth library's server helper. Do not pass the raw access token into a client component so the component can store it.

If you move from a bearer header to a cookie, the browser attaches that cookie on its own. That is a different CSRF shape than a header the script had to set. Next.js compares the Origin header to the Host header (or X-Forwarded-Host) on Server Actions and aborts the request when they do not match. That comparison is for Server Actions. A cookie-authenticated Route Handler that changes data needs its own Origin or CSRF check. MDN and the OWASP session sheet both treat SameSite as one CSRF control, not the whole defense.