#Help with storing user's state

8 messages · Page 1 of 1 (latest)

spiral sorrel
#

I'm setting up authentication for my next app. I have got the whole login and session token (JWT) figured out (the JWT token is stored in the cookie). But I can't figure out where do I store the user's state, whether the user is logged in or not. I am not using next-auth, but in simple terms, I am looking for my own implementation of next-auth's getServerSession and getClientSession funcitons.

grizzled flintBOT
#
Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

tame echo
spiral sorrel
tame echo
# spiral sorrel yeah, for that i created a middleware which verifies jwt. But im not sure how do...

I think you may be confused about JWTs
A JWT is a signed payload, it is signed by the server.
The client can modify the payload, sure, but then they can't re-sign the JWT so it becomes invalid

You could intercept the JWT to 'trick the client' into being authorised, but any sensitive actions should verify the sent JWT again (which would fail as it got tampered)

You could also verify the JWT and return server components instead, so the client never has access to sensitive UI

#

So what I'm saying, is store the users auth role (or an DB/ID link) in the JWT, the server will verify the JWT then return the relevant content (such as an admin panel) if the user is authorised

#

You shouldn't need to use another cookie for something else?

spiral sorrel