{"action":"created","issue":{"url":"https://api.github.com/repos/zeit/next.js/issues/4569","repository_url":"https://api.github.com/repos/zeit/next.js","labels_url":"https://api.github.com/repos/zeit/next.js/issues/4569/labels{/name}","comments_url":"https://api.github.com/repos/zeit/next.js/issues/4569/comments","events_url":"https://api.github.com/repos/zeit/next.js/issues/4569/events","html_url":"https://github.com/zeit/next.js/issues/4569","id":330693144,"node_id":"MDU6SXNzdWUzMzA2OTMxNDQ=","number":4569,"title":"How to serve an already authenticated client to browser? / How to protect api?","user":{"login":"mxhryvo","id":28533065,"node_id":"MDQ6VXNlcjI4NTMzMDY1","avatar_url":"https://avatars1.githubusercontent.com/u/28533065?v=4","gravatar_id":"","url":"https://api.github.com/users/mxhryvo","html_url":"https://github.com/mxhryvo","followers_url":"https://api.github.com/users/mxhryvo/followers","following_url":"https://api.github.com/users/mxhryvo/following{/other_user}","gists_url":"https://api.github.com/users/mxhryvo/gists{/gist_id}","starred_url":"https://api.github.com/users/mxhryvo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mxhryvo/subscriptions","organizations_url":"https://api.github.com/users/mxhryvo/orgs","repos_url":"https://api.github.com/users/mxhryvo/repos","events_url":"https://api.github.com/users/mxhryvo/events{/privacy}","received_events_url":"https://api.github.com/users/mxhryvo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-08T14:59:51Z","updated_at":"2018-06-12T09:08:07Z","closed_at":null,"author_association":"NONE","body":"Hey guys,\r\nthanks for this awesome project - I love to use it.\r\nBut now I wanted to make my API (express-server seperated from my custom next js server) more protected - so that its harder so send requests to api that don't come from the next js react-client. I don't want to use client side authentication to api with users - because non-registered users should access some parts of api, too.\r\n\r\nHow do I do that?\r\n\r\nI thought of an \"/auth\" endpoint on API that can just be accessed from next js server and that gets the cookie with api token. But the next-server needs to pass that cookie or session to rendered client. The api token should be session-based\r\n\r\nOr is there a better way? The goal is that you should just use Postman and GET-request to \"http://api.com/getData\" and use my api for your service or app. Of course its impossible to make it as secure as with user authentication - but I have an app that most people will use without registration.\r\n\r\nI hope you could give me some hints and tips.\r\nThanks!\r\n"},"comment":{"url":"https://api.github.com/repos/zeit/next.js/issues/comments/396520605","html_url":"https://github.com/zeit/next.js/issues/4569#issuecomment-396520605","issue_url":"https://api.github.com/repos/zeit/next.js/issues/4569","id":396520605,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjUyMDYwNQ==","user":{"login":"josephluck","id":11628330,"node_id":"MDQ6VXNlcjExNjI4MzMw","avatar_url":"https://avatars0.githubusercontent.com/u/11628330?v=4","gravatar_id":"","url":"https://api.github.com/users/josephluck","html_url":"https://github.com/josephluck","followers_url":"https://api.github.com/users/josephluck/followers","following_url":"https://api.github.com/users/josephluck/following{/other_user}","gists_url":"https://api.github.com/users/josephluck/gists{/gist_id}","starred_url":"https://api.github.com/users/josephluck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josephluck/subscriptions","organizations_url":"https://api.github.com/users/josephluck/orgs","repos_url":"https://api.github.com/users/josephluck/repos","events_url":"https://api.github.com/users/josephluck/events{/privacy}","received_events_url":"https://api.github.com/users/josephluck/received_events","type":"User","site_admin":false},"created_at":"2018-06-12T09:08:07Z","updated_at":"2018-06-12T09:08:07Z","author_association":"NONE","body":"You're right - when the user is given a token, they are able to use that token to retrieve data from your API if you allow them to do so. You can restrict the access level the token grants by encoding data in the JWT that identifies the user. You can use this information to restrict which API endpoints they are able to use.\r\n\r\nAlso, you can set your JWT token to expire whenever you like - you would also make it expire after every session if you need to, by setting a cookie through the express server."}}
{"actor":{"display_login":"josephluck"}}