NextJS does per-page code splitting. Does it provide an option so that we can prevent access to client-side JS files for certain pages (and instead show 403) if a valid JWT token is not present in the request? We are trying to make it so that people cannot steal our JS if they are not logged-in. I can see that I can probably do this with a custom server script (https://nextjs.org/docs/advanced-features/custom-server), by inspecting the URL and headers, but would rather not do this as the page warns that "Before deciding to use a custom server, please keep in mind that it should only be used when the integrated router of Next.js can't meet your app requirements. A custom server will remove important performance optimizations, like serverless functions and Automatic Static Optimization." Does it provide support for this without needing to create a custom server?
#Check user is logged in before serving page JS
zenith crow
weak tundra
I'm not sure how you are doing your auth but it sounds like the information you need is in your request headers.
Sounds like a good case for Next.js middleware https://nextjs.org/docs/advanced-features/middleware. You have access to headers and also cookies information. You can examine each request in middleware and determine if the user is logged in or not. Based on that you can either let the user continue on or redirect them to whatever page you want for not logged users
zenith crow
Is middleware called on requests for js files though?