Keep sessions in httpOnly cookies and validate them on the server (Server Components and Route Handlers). Use middleware mainly for routing/redirects, but still enforce auth in server code. Avoid relying only on client checks, and be careful with static rendering when content depends on the user.