I have guest users that still need to be able to write into the database. The only thing i want to prevent are users you go to the URL/use postman to do: www.website.com/api/route/random-type . To make a get request.

I've tried blocking it by checking if the cookies and the url match. But sadly, the url/route/query is not available on first load. (undefined).

export default async function handler(req, res) {
  const { method } = req;
  const userId = req.query.id; //undefined
  const userCookieId = req.cookies?.uid || req.cookies?.guestId; 
  const authUser = userId === userCookieId;
}