NextAuth seperate backend

[georgekrax]

Hello everyone,

I have an application that uses NextAuth.js with the help of /pages/api server pages. However, the project is getting massive and has big scale, and I would like to split the frontend with the backend. Any ideas, on how this can work while keeping NextAuth. Should j get rid of it and implement something custom on my own?

Thanks in advance

[balazsorban44]

What do you mean exactly?

[praveshsapkota]

glad to help 😀

@georgekrax
i guess you can make this discussion answered and change the discussion topic to something more describing so it might help others too

[balazsorban44]

I have had a similar problem i had a existing graphql server with prisma database and i authenticated user in frontend using /api serverlessly and i need to authenticate users for there permission if there are authorized to access api or not and my solution i will state below its not perfect but it works

You can see in session callback i am sending user role and a signed JWT which containes user information and its signed so that no one can temper it . you can access the session inside your react using useSession hook

you can send that signed JWT to server with http request header authorization : "bearer Token"

Hello everyone,

I have an application that uses NextAuth.js with the help of /pages/api server pages. However, the project is getting massive and has big scale, and I would like to split the frontend with the backend. Any ideas, on how this can work while keeping NextAuth. Should j get rid of it and implement something custom on my own?

Thanks in advance

If you decide to run your own auth system, hopefully you don't save passwords in plain text as you do on the image. 👀 I recommend against using the credentials flow unless you have a dedicated person/team concerning security. storing passwords correctly is crucial.

You also seem to leak the userAccount between calls. I don't have much experience, but I feel you shouldn't be doing that either. You could refactor the code to be able to save that only in the context of the invocation of the endpoint.

same with apiToken

Furthermore, dotenv isn't necessary in Next.js

[praveshsapkota]

@balazsorban44

I havent completely implemented credentials provider it was there just for the custom login page

about passwords i will hash and save in db and would compare its when signing in

and about leaking userAccount and apiToken

i didnt quite get about saving only in context of invocation of endpoint
can you please elaborate or point me to some sort of docs

thanks for the suggestions 😅

[balazsorban44]

export default async function auth(req, res) {
  // save anything here
  return await NextAuth(req, res, {
    //... your options
  })
}

[praveshsapkota]

👍🏻

[georgekrax]

@balazsorban44 I also have another question. Can I create a custom OAuth provider and pass it to NextAuth.js, as I have a second backend which is where "true" really authentication happens?

[georgekrax]

One last question, is it possible to return a JWT token in the authorize() function, which I have created, and do not pass a jwt() callback?

[balazsorban44]

Whatever you return in authorize will be available in the jwt callback, but you can save your own jwt in there without a problem, as long as you remain under 4096 bytes which is the maximum cookie size.

[georgekrax]

Okay, so I can directly return my token in the jwt() callback. Can NextAuth also handle refresh tokens?

[balazsorban44]

Not currently https://next-auth.js.org/tutorials/refresh-token-rotation

a note if you look at the above link to implement it yourself, I suggest encrypting the generated JWT as it should not be exposed to the frontend in any way.

[georgekrax]

Oh okay. Thank you for all of your help!