Authorization, best practice in Remix.run

[frigid sluice]

Hi there,

I have been working on side project in Remix.run. And I need authorization. I cannot find any resource or documentation on the web. For auth, there is remix-auth package, but for authorization nothing. Currently, for each page/route I'm checking in loader if the user has authorization to access that route, but this is too verbose. Any best practice for this?

[hollow wagon]

Hello, yes checking the authorization in the loader is the current best way to do it.
In a futur version of remix, middleware will be added to minimize this kind of work.
You can find more information in the RFC about middleware : https://github.com/remix-run/remix/discussions/7642

[next dirge]

You can also make a custom express server in front of your remix app that checks auth and passes it to the remix object if you’d prefer all auth checks happen at the start of your app.

[frigid sluice]

Well, then I am tied to express and node, and I don't want that...

[next dirge]

If you’re using the remix dev server for deployment you are already using express and node. Swapping the runtime isn’t all that expensive considering it’s probably a 30-50 line change to make it work for any different runtime. But it’s up to you if you want to handle auth before it gets to remix

But my suggestion still stands but for whatever runtime you’re looking to use. The only way you couldn’t use my suggestion is if you’re building remix as a SPA using only clientLoaders and client actions

[tawny estuary]

authentication is "easy" to de generacally
but authorization can not always be done this way, especially in Remix without middlewares. Personnaly I don't mind doing specific authorization for each endpoint (each loader and each action), but i'll think i'll require something to ensure that authorization was not forgotten

[neat blade]

i do smth like requireUser function and return the user and if i want user object i can just have it from there

[onyx halo]

You can check this stack, it has a complete authentication code set up among others configurations https://github.com/epicweb-dev/epic-stack/blob/main/docs/authentication.md

[frigid sluice]

I have already took a look at that, but there is no authorization, only authentication...

[onyx halo]

Ahh sorry

[cobalt cloud]

There’s an undocumented Authorizer class in Remix Auth, but I never marked it as stable and documented it

The main thing is that authorization is too custom, in other frameworks you either need middlewares or you authorize at the data layer (eg in models) but since Remix has no data layer is hard to do something specific of Remix

In my experience, it’s better to just write functions where you can validate access to a route or resource and then call them when needed

[frigid sluice]

I get it now, and will do what @cobalt cloud said...