API route publicly accessible?
Answered
Chum salmon posted this in #help-forum
Chum salmonOP
Why are the app router API route handlers publicly accessible? I was reading up on it and to my understanding, your APIs should be under /app/api/X/route.js which you can fetch from your components.
But this completely exposes your API to anybody? Wouldn't you want your API to be secure and unaccessible/not routable?
But this completely exposes your API to anybody? Wouldn't you want your API to be secure and unaccessible/not routable?
Answered by @ts-ignore
yes it does expose your route to everyone. The security of your API is upto you, you should perform proper validation before performing any action. That's how the whole REST api architecture works
25 Replies
@Chum salmon Why are the app router API route handlers publicly accessible? I was reading up on it and to my understanding, your APIs should be under /app/api/X/route.js which you can fetch from your components.
But this completely exposes your API to anybody? Wouldn't you want your API to be secure and unaccessible/not routable?
yes it does expose your route to everyone. The security of your API is upto you, you should perform proper validation before performing any action. That's how the whole REST api architecture works
Answer
@@ts-ignore yes it does expose your route to everyone. The security of your API is upto you, you should perform proper validation before performing any action. That's how the whole REST api architecture works
Chum salmonOP
What do you recommend when I'm working with private information like when I need to request from my API to get user data? Have an Authorization header or something?
@Chum salmon What do you recommend when I'm working with private information like when I need to request from my API to get user data? Have an Authorization header or something?
yes, send the auth header to server and fetch data from the auth header value not from the query or body supplied by the user
@@ts-ignore yes, send the auth header to server and fetch data from the auth header value not from the query or body supplied by the user
Chum salmonOP
what do you mean by "fetch data from the auth header value"? I thought the auth header was to simply grant access to the API and get a valid response back?
@Chum salmon what do you mean by "fetch data from the auth header value"? I thought the auth header was to simply grant access to the API and get a valid response back?
get the token from header, decode it to get whatever unique identifier for user it had, fetch the user and before doing any other action like fetching data from db or writing data to db, check if that user is allowed to do that
@@ts-ignore get the token from header, decode it to get whatever unique identifier for user it had, fetch the user and before doing any other action like fetching data from db or writing data to db, check if that user is allowed to do that
Chum salmonOP
hmm. It just seems a little strange that I need to make requests to my own server to render a page. That is how you do it, right? Like I have a GET route,
findPartsFittingMachine.js which is responsible for returning what machines a part fits based on the part number. So I have to create that route, then call that in my server component? Why not just directly query the database in my server code so I don't have to make a request against my own server?@Chum salmon hmm. It just seems a little strange that I need to make requests to my own server to render a page. That is how you do it, right? Like I have a GET route, `findPartsFittingMachine.js` which is responsible for returning what machines a part fits based on the part number. So I have to create that route, then call that in my server component? Why not just directly query the database in my server code so I don't have to make a request against my own server?
you can do everything in server component which you can do in an API route
querying db, adding records to db
Chum salmonOP
oh, your API endpoints are only for client components?
Okay, cool
Original message was deleted
Chum salmonOP
also, how does your
getServerAuthSession() function know any request headers/cookies without it being passed in?@@ts-ignore you can do everything in server component which you can do in an API route
Chum salmonOP
One thing just struck me, if I'm not using
fetch anymore, how would I make it so NextJS caches those calls? Is that not a NextJS thing, more of a Node and my implementation kind of thing?@Chum salmon One thing just struck me, if I'm not using `fetch` anymore, how would I make it so NextJS caches those calls? Is that not a NextJS thing, more of a Node and my implementation kind of thing?
even if you are directly fetching data in server component then nextjs will cache it automatically
@@ts-ignore even if you are directly fetching data in server component then nextjs will cache it automatically
Chum salmonOP
It'll automatically cache this?
which is just this
it should iirc
Chum salmonOP
hmm, well if Next is caching it then it should have ISR support? Like how would you set the revalidate seconds parameter on this example?
I feel like when I read it, it said Next supported caching on fetch calls because it extends upon it
I think this might talk about it. I'll have to read this...
Ah, you just add your exports to your page and Next should do the rest
But it looks like you were right too, it does try and cache as much as possible by default.