#Middleware help

6 messages · Page 1 of 1 (latest)

glad anchor
#

Hi so I have the following middleware:

import { NextResponse } from "next/server";
import type { NextRequest } from 'next/server'
import { decode } from 'next-auth/jwt';

export default async function middleware(req: NextRequest) {
//console.log(req.cookies.get("next-auth.session-token"));
const sessionToken = req.cookies.get("next-auth.session-token")?.value;

const decoded = await decode({
token: sessionToken,
secret: process.env.NEXTAUTH_SECRET || '',
});
if (!decoded) return NextResponse.redirect(process.env.MIDDLEWARE_REDIRECT || '');
return NextResponse.next();
}

export const config = {
matcher: ['/dashboard'],
}

is this considered safe? Wouldnt it be remarkably easy to fake a jwe in this case to bypass?

warm onyxBOT
#
Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

glad solstice
worldly ferry
#

Yes, because middleware runs on the server it is ok to incliude sensitive data

glad anchor
glad anchor