3 ms·

I’m really interested in how you got the auth to interoperate between nextjs and python. I find auth to be the most difficult part of making blended code proje

I’m really interested in how you got the auth to interoperate between nextjs and python. I find auth to be the most difficult part of making blended code projects with JavaScript on the frontend like this.

twolf910616 2y ago
authn or authz? Authentication is not terrible to build but authorization yeah, I'm totally with you there. It's hard.
eigenvalue 2y ago
Well you don't really need to get the auth to interoperate per se; the only machine that is allowed to connect to the FastAPI backend is the machine running the NextJS app, and it passes along the email address of the user making the request to the FastAPI backend. And the user auth stuff in NextJS is incredibly easy using the standard Next-Auth flow: https://next-auth.js.org/ https://next-auth.js.org/ You basically just set up a new application in the Google Cloud console, enable the Google Plus API for the app, and create the OAuth keys, and that's about it. Just add the secret key and identifier to your .env file for the NextJS app and it "just works".
- daft_pink 2y ago
  So essentially, you only let the server side rendering function, access the API and don’t secure it at all beyond that? You could essentially use a static JWT token that only that nexts cloud function knows?
  - eigenvalue 2y ago
    Yeah, I restrict it by the IP address, so the FastAPI backend can only receive connections from localhost or the one machine running the NextJS app. There are certainly lots of ways you could restrict it, such as using a password or key.
benn0 2y ago
I've been doing this with NextAuth and fastapi-nextauth-js [https://github.com/TCatshoek/fastapi-nextauth-jwt https://github.com/TCatshoek/fastapi-nextauth-jwt]. With JWTs it's pretty straightforward to do something similar for any other auth provider. This is also using NextJS rewrites (see [https://vercel.com/templates/python/nextjs-fastapi-starter https://vercel.com/templates/python/nextjs-fastapi-starter] for an example)

twolf910616 2y ago

authn or authz? Authentication is not terrible to build but authorization yeah, I'm totally with you there. It's hard.

eigenvalue 2y ago

Well you don't really need to get the auth to interoperate per se; the only machine that is allowed to connect to the FastAPI backend is the machine running the NextJS app, and it passes along the email address of the user making the request to the FastAPI backend. And the user auth stuff in NextJS is incredibly easy using the standard Next-Auth flow: https://next-auth.js.org/ https://next-auth.js.org/ You basically just set up a new application in the Google Cloud console, enable the Google Plus API for the app, and create the OAuth keys, and that's about it. Just add the secret key and identifier to your .env file for the NextJS app and it "just works".

daft_pink 2y ago
So essentially, you only let the server side rendering function, access the API and don’t secure it at all beyond that? You could essentially use a static JWT token that only that nexts cloud function knows?
- eigenvalue 2y ago
  Yeah, I restrict it by the IP address, so the FastAPI backend can only receive connections from localhost or the one machine running the NextJS app. There are certainly lots of ways you could restrict it, such as using a password or key.

benn0 2y ago

I've been doing this with NextAuth and fastapi-nextauth-js [https://github.com/TCatshoek/fastapi-nextauth-jwt https://github.com/TCatshoek/fastapi-nextauth-jwt]. With JWTs it's pretty straightforward to do something similar for any other auth provider. This is also using NextJS rewrites (see [https://vercel.com/templates/python/nextjs-fastapi-starter https://vercel.com/templates/python/nextjs-fastapi-starter] for an example)