Force OAuth flow when user enters secure page

[worthy turtle]

Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

[shell fractal]

you can check if the user is logged in for example to be able to view the page. If he's logged in, you can show him the page. If he's not, then redirect him to the login page.

That system works the best when using it with middleware

[shell fractal]

don't you have a login page?

[proud furnace]

He may have a system kind of like what we use at our company where we protect our apps behind Google IAP, but then we also verify those headers automatically (using a custom next auth provider) when the user signs in

In our case, the "sign in" page is just the / page for the website, which checks if the user has a session, and then if they don't, it automatically hits a server action to authorize them

And then we have middleware that redirects to that page if no session is found as well

[shell fractal]

... it automatically hits a server action to authorize them
Why don't you do the same for a secure page?

[proud furnace]

Like instead of middleware that redirects to the index page?

Or are you saying just check the headers on middleware?

[shell fractal]

yes, checking the headers in middleware and if they are not present, then authorize them

[proud furnace]

Fantastic point, I should have mentioned that we also take those headers and call an internal company endpoint to get additional data about that employee from our employees DB, and double check if they're on probation, get roles, etc

So unfortunately can't just do the headers, it's kind of a double process of check headers, get internal data, and then attach relevant info to the session

but if we didn't have that step, only using middleware would be the way to go all day

I can post a rough example of how we do it here if that'd be helpful @spiral sail

[shell fractal]

@spiral sail@proud furnace are you working for the same company?

[proud furnace]

Haha, I don't think so, that'd be a crazy coincidence though

[shell fractal]

haha alright. I guess that's to confusing for me

[proud furnace]

Hahaha, I'll post try and put a basic demo on github

It's definitely a little bit contrived, feels weird using a custom credentials provider without any actual credentials