9 ms·
i love vercel and use it for all my projects, right up until i need to add auth/api, at which point I switch off of it immediately for security reasons because
by bionhoward 6y ago
i love vercel and use it for all my projects, right up until i need to add auth/api, at which point I switch off of it immediately for security reasons because there are no static IPs unless you're an "enterprise" customer
it's unclear why they're rolling out performance features while this critical security hole persists. no doubt i'll get flamed for it, but, it's a really bad idea to use dynamic IPs to connect to your database with only a password...
- luisrudge 6y agoI guess you’re talking about Vercel.com instead of Next.JS, right?
- bionhoward 6y agoYep
- djstein 6y agoCan you expand on what the static IPs give you?
- wereHamster 6y agoFor use in firewall rules
- maxast 6y agooh yeah, I remember running into that problem when I was using a database on Digital Ocean and wanted to add vercel api routes as a trusted source. I had also switched off of it because of that. However, I had a look at their blog the other day and apparently they have an Anycast IP range now, which probably solves this issue https://vercel.com/blog/new-edge-dev-infrastructure#vercel's-own-anycast-ip-range https://vercel.com/blog/new-edge-dev-infrastructure#vercel's.... I haven't tried it yet though