basically am using the nextjs middleware file which is at the root level, and i want to make a simple authGuard where i can verify if there is a token or not and if that token belongs to someone, but the problem is that i cannot access data from the context since its server side middleware, so how should i proceed ? do i need to put it inside a cookie aswell ?
#Where to store the accessToken if you would need it in nextjs middleware
knotty zealot
prime summit
if you cannot query your database to check if the decoded token ID belongs to someone, all you would do is check in the middleware if the token is expired or not
If not, attach the decoded token payload to the request object and then in your API routes check if that user exists in the database
knotty zealot
could you show me how to do so for this part :
"If not, attach the decoded token payload to the request object and then in your API routes check if that user exists in the database"
prime summit
Ah yes, this could be interesting. If you're using jsonwebtoken, you won't be able to call the .verify method as it uses node APIs that cannot be run in the middleware
prime summit
I believe the jose JWT library can be used at the middleware for token decoding https://www.npmjs.com/package/jose
prime summit
Yes
And for the code, I can supply some
But I'd suggest you try it yourself, theres documentation how to set request headers on nextjs
knotty zealot
i would like to ask you a question if u don't mind
prime summit
But basically, you want to check if the Authorization header is present, if it is - get the token and verify it. If you can verify it and it hasn't expired, query your database with the ID to check if a user exists
If it does, attach it to the headers, then you can access it in your services
And yeah, go for it. I'll try and answer the questions
( I am at work but I'll try my best lmao)
knotty zealot
do you know why i can't use the jsonwebtoken instead of jose ?
it says something related
to edge
but i am a newbie in nextjs so didn't understand it
prime summit
I could be very wrong
But I believe the nature of edge routes/middleware is they cant use underlying NodeJS apis as they don't have access to them
So you're going to have to use another library like jose which I believe does a similar thing as jsonwebtoken but uses APIs with different functionality but achieving similar outcomes (aka, can decode tokens)
Heres the nextjs explanation: https://nextjs.org/docs/messages/node-module-in-edge-runtime
knotty zealot
Ooooh i see makes sense
also i would like to get your opinion about this approach:
instead of attaching the decoded token payload to the request object etc as u suggested i was thinking about also putting the accessToken alongside the refreshToken in cookie wdyt
prime summit
Refresh token in cookie goes well
Access token in payload stored in LS/global state works alright too as its short lived
Only if you combine refresh and access tokens you'll need API endpoints to generate access tokens when they expire (aka, only sending the refresh token cookie)
You could store access token in cookie, but you'd want to check if middleware can access cookies (I think it can)
knotty zealot
yes it can
because if store the token in global state ( aka context ) u can't access it in middleware
prime summit
Yes you can
You'd send it in the header of the request
E.g. Authorization Bearer ${token}
knotty zealot
i think i don't need to send it in the request header if he's in the cookie i can do smth like this no ? :
const accessTOken= request.cookies.get(ACCESS_TOKEN_COOKIE)?.value
knotty zealot
that smiley face means many things hahahah
prime summit
Hahaha
knotty zealot
is it bad practice ?
am sorry if am bothering you during your work we can still talk later on if u want !
prime summit
Don't think so
Its fine to store access token in local storage
Its fine to store access token in cookie
Many ways to skin the cat
Its just preference
prime summit
am sorry if am bothering you during your work we can still talk later on if u wa...
All good 
knotty zealot
Alrighty ! ill still take a look on what you told me about attaching the token in the header tho ! and thank you very much for your time and your help !
i appreciate it 😄
prime summit
All good... I am on and can help if need be
knotty zealot
sure thing ! i appreciate it !
prime summit
🤠
knotty zealot
Heey man ! are you here ?
knotty zealot
oh its fine ! problem solved :p