How do I reset cookies on site re-entry?
Unanswered
Asiatic Lion posted this in #help-forum
Asiatic LionOP
I'm struggling with Next.js stateless architecture.
What I wanted was the following:
- On page entry, create a JWT token containing an
- Client component makes a fetch call to my API route to download data
- Middleware updates the JWT token
- On page refresh ergo site re-entry (not page navigation), reset the
My problem is that when I can't figure out how to reset the
The idea is I want to keep the API route secure by leaving it open for subsequent access. The route itself is called by my client-side component, which receives a redirect link to download content into my component. I don't want the API route left open for someone to be able to subsequently download the content to their computer
Would
What I wanted was the following:
- On page entry, create a JWT token containing an
isDownloaded flag set to false- Client component makes a fetch call to my API route to download data
- Middleware updates the JWT token
isDownloaded flag to true - On page refresh ergo site re-entry (not page navigation), reset the
isDownloaded to falseMy problem is that when I can't figure out how to reset the
isDownloaded to false on site re-entry/page refreshThe idea is I want to keep the API route secure by leaving it open for subsequent access. The route itself is called by my client-side component, which receives a redirect link to download content into my component. I don't want the API route left open for someone to be able to subsequently download the content to their computer
Would
iron-session help?15 Replies
Asiatic LionOP
Is Next.js not capable of resetting the session on page reload?
The fact API routes can't be restricted to single access is a huge weakness
@Asiatic Lion I'm struggling with Next.js stateless architecture.
What I wanted was the following:
- On page entry, create a JWT token containing an `isDownloaded` flag set to `false`
- Client component makes a fetch call to my API route to download data
- Middleware updates the JWT token `isDownloaded` flag to `true`
- On page refresh ergo site re-entry (not page navigation), reset the `isDownloaded` to `false`
My problem is that when I can't figure out how to reset the `isDownloaded` to `false` on site re-entry/page refresh
The idea is I want to keep the API route secure by leaving it open for subsequent access. The route itself is called by my client-side component, which receives a redirect link to download content into my component. I don't want the API route left open for someone to be able to subsequently download the content to their computer
Would `iron-session` help?
you can set the cookie on load by [using middleware](https://nextjs.org/docs/app/building-your-application/routing/middleware#using-cookies); but this additional layer of security is basically useless – you cannot restrict api route usage to requests from your frontend only, because users can always open the network tab, find the request, copy that request and use it for postman/thunder client/curl/anything and there is no way your backend can detect that
this is not a bug or a limitation of nextjs, it's just how HTTP endpoints work in all applications in existence
@joulev this is not a bug or a limitation of nextjs, it's just how HTTP endpoints work in all applications in existence
a solution would be a CSRF token i think?
@DirtyCajunRice | AppDir a solution would be a CSRF token i think?
csrf tokens can mitigate it, but it doesn't prevent any users from accessing the endpoint via postman/curl/etc. – if those users want to do that nothing can stop them
users can always csrf attack themselves
true. damn.
Asiatic LionOP
Oof, it sounds like restricting API routes to just single-access isn't possible then. My goal was to have a secure way of loading my data from the server into the client while preventing someone from subsequently acessing that data by just calling the API route or finding the route in the network. I tried signed urls with my Express backend, but ran into similar issues
I don't know if using a server-side prop or the experimental server functions could help eliminate the need for accessing my API endpoint
@DirtyCajunRice | AppDir a solution would be a CSRF token i think?
Asiatic LionOP
I tried that and I tried with JWT, but the issue with the JWT was that I couldn't figure a way of resetting it on page/site reload/refresh/re-entry (not site navigation)
I would have preferred maintaining a session while the page to the website was active and on refresh or site re-entry, resetting the session
ultimately... this is solved by server components
no endpoint for them to hit
@DirtyCajunRice | AppDir ultimately... this is solved by server components
Asiatic LionOP
Hundred percent would but I'm also using Three.js which is entirely client-side. I wanted to use the API endpoint to return a signed url that would download my model, avoiding public storage of the data but the additional overhead of securing the API endpoint has been a tough cookie to crack