Authentication
Unanswered
Doberman Pinscher posted this in #help-forum
Doberman PinscherOP
Hey guys, i'm building a next project right now with my backend-friend, he already made some routes/endpoints using django rest framework, and now i need to make an authroization. I came across nextauth but couldn't really understand how to use it to connect to my friend's backend. It seems like i need to use credentialProvider for the request, but i was not able to find any examples for both registering the user and logging in, it mostly includes only logging in. Do i need to process the registering by myself or am i missing something?
33 Replies
Doberman PinscherOP
Like really, should i even use nextauth for this? I don't work with db directly, only sending requests to my friend's crud operations
Alligator mississippiensis
authorization is on the backend
im going to assume that youre using tokens
Doberman PinscherOP
yep
Alligator mississippiensis
either bearer or jwt
same concept though
Doberman PinscherOP
jwt
Alligator mississippiensis
store the jwt on the client browser in a cookie or session storage or browser storage or whatever
send it to the backend in the authorization header (obviously) with each request
check on the backend if they have access to whatever theyre requesting
if they dont dont send it
people can access any page on ur site thats public and on the client just dont send the data to fill the page
Doberman PinscherOP
so i don't have to use any libraries pretty much?
Alligator mississippiensis
no
jwts are just a way for the server to verify that a request is legit
server -> client -> server
i dont use drf so idk exactly what the setup would be like but its all the same
Doberman PinscherOP
okay, gotchu, thanks!!!!~
Alligator mississippiensis
ye
Doberman PinscherOP
but what if i would want to implement an oauth like a github or discord? Is it better to be on a back or front? If front is the key, do i need to use the lib then?
Alligator mississippiensis
oh i misread that like a signin with other app thing?
same thing if youre talking about authorization
authentication and authorization are different
authentication verifies who you are
authorization verifies that that person has access to whatever they want to access
Doberman PinscherOP
ah
Alligator mississippiensis
when you login you authenticate
Doberman PinscherOP
oops
Alligator mississippiensis
then you get a token
and that token is signed by the server saying that you are indeed who you are
then when you send another request asking for something else you pass the token in the request so the server knows who you are and then can check whether or not you are authorized to get the data you want
Doberman PinscherOP
yeah i meant the authentication all that time, sorry
Alligator mississippiensis
i dont use oauth or an sso type thing so idk but im sure its all on their website