Next.js Discord

Discord Forum

Middleware with dynamic route context

Answered
Oriental chestnut gall wasp posted this in #help-forum
Open in Discord
Oriental chestnut gall waspOP
Is it possible to only check for dynamic routes if the user currently logged in via NextAuth is allowed to visit the page? I am not using any role based authentication. It should check if the author of a post, where the id is part of the dynamic page, is equal to the currently logged in user.
Answered by B33fb0n3
yea, I think it's the best thing to check the auth via the middleware and check inside the page.js (where you fetch the data in both cases) if he's allowed to see the content. If so, show the page else use the notFound function
View full answer

15 Replies

B33fb0n3
yes, you can fetch stuff inside the middleware and also be able to retrieve the fetched data inside the middleware. The check is a basic if function and the return is normally a NextResponse @Oriental chestnut gall wasp
Oriental chestnut gall waspOP
And how can I combined two middlewares? One for checking if the user is authenticated at all and the second one for checking if the user is allowed to do a specific action when logged in?
So I would probably need 2 different matchers, one for each middleware
if (isAuth) { ... if (isAllowed) { ...} } etc.
matchers are configuring what routes are protected by the middleware
so your matcher must include at least all your routes that require a priviledged access
If you don't manage to set that up in a middleware (eg becasue you need to call a database that do not use the HTTP protocol), you may also make each relevant page a React Server Component (so if you have client code in it, move it to another file) and check from there
like "export async function MyPage() { const user = await getCurrentUser() ; const isAllowed = await checkIfAllowed(user, "/my-page"); return <MyPageClient />"
Oriental chestnut gall waspOP
So it might be the best idea to let the middleware check if the user is logged and exclude all pages for him where he has to be authenticated. And then check in the specific pages rather he is allowed to access the page when logged in or not, right?
@Oriental chestnut gall wasp So it might be the best idea to let the middleware check if the user is logged and exclude all pages for him where he has to be authenticated. And then check in the specific pages rather he is allowed to access the page when logged in or not, right?
B33fb0n3
yea, I think it's the best thing to check the auth via the middleware and check inside the page.js (where you fetch the data in both cases) if he's allowed to see the content. If so, show the page else use the notFound function
Answer
Oriental chestnut gall waspOP
Alright. Thank you :D
B33fb0n3