3 ms·

I don't know next.js, can someone explain how the client side can call a server function inside of an IF on the client side for security? It seems like there w

I don't know next.js, can someone explain how the client side can call a server function inside of an IF on the client side for security? It seems like there would be a trivial bypass of the security from the client side.

chrysoprace 1y ago
It opaquely makes a network call. You call it from the client-side and it abstracts away the network round-trip, but inside the function context you're running code on the server. Under the hood it opens up an endpoint and the function calls it via a HTTP request.
- rileymat2 1y ago
  I am not arguing because I am ignorant and curious, but if "if (isOwner(userMail, resource.ownerMail)) { // grant access }" is on the client side, and the code for isOwner is async on server side as described, returning a promise waiting on the network call, isn't that trivial to hack?
  - chrysoprace 1y ago
    The calling code is on the client. It's effectively a `await fetch('...generated-endpoint')` that looks like the code runs as part of the same process due to some type inference at dev time, but when you run a build it uses the `'use server'` marker described in the article to determine what to build out as server artifacts (i.e. lambdas). You have to do your typical validations and auth logic on the server since anybody could call the endpoint without needing to use the function handle. There's a lot of magic and it seems to trip up a lot of people, including the people in the article.
    - rileymat2 1y ago
      Yes, this is my misunderstanding, if the calling code (client code) has the "if" with the secure block in the curly braces that should not be executed. A client side attack can just jump over that server call in a variety of ways, from mitm to running in a debugger to patching it out.
      - chrysoprace 1y ago
        It'd be no different from a fetch request. The inside of the function (the conditional) is run on a different machine with a different runtime process.
        Izkata 1y ago
        They're not asking "how does this work?", they're asking "how is this secure?". The answer is, it's not. This is terrible code and should never be written like this - the check can be bypassed client side, letting the user act as an owner no matter what the response claimed.

chrysoprace 1y ago

It opaquely makes a network call. You call it from the client-side and it abstracts away the network round-trip, but inside the function context you're running code on the server. Under the hood it opens up an endpoint and the function calls it via a HTTP request.

rileymat2 1y ago
I am not arguing because I am ignorant and curious, but if "if (isOwner(userMail, resource.ownerMail)) { // grant access }" is on the client side, and the code for isOwner is async on server side as described, returning a promise waiting on the network call, isn't that trivial to hack?
- chrysoprace 1y ago
  The calling code is on the client. It's effectively a `await fetch('...generated-endpoint')` that looks like the code runs as part of the same process due to some type inference at dev time, but when you run a build it uses the `'use server'` marker described in the article to determine what to build out as server artifacts (i.e. lambdas). You have to do your typical validations and auth logic on the server since anybody could call the endpoint without needing to use the function handle. There's a lot of magic and it seems to trip up a lot of people, including the people in the article.
  - rileymat2 1y ago
    Yes, this is my misunderstanding, if the calling code (client code) has the "if" with the secure block in the curly braces that should not be executed. A client side attack can just jump over that server call in a variety of ways, from mitm to running in a debugger to patching it out.
    - chrysoprace 1y ago
      It'd be no different from a fetch request. The inside of the function (the conditional) is run on a different machine with a different runtime process.
      - Izkata 1y ago
        They're not asking "how does this work?", they're asking "how is this secure?". The answer is, it's not. This is terrible code and should never be written like this - the check can be bypassed client side, letting the user act as an owner no matter what the response claimed.