Missing Authorization key from headers
Unanswered
Pacific saury posted this in #help-forum
Pacific sauryOP
I have this code on my client side
const response = await fetch("/api/updateTicket", {
// replace '/api/update-route' with your route
method: "PUT",
headers: {
"Content-Type": "application/json",
Authorization:
},
body: JSON.stringify({
address: owner,
raffle: raffleID,
updateType: "FROM_NULL",
}),
});
when I log this on the route, the Authorization is not even there in the headers... how am I supposed to protect serverless functions if I cant pass a token? Whats wrong here? Thank you
const response = await fetch("/api/updateTicket", {
// replace '/api/update-route' with your route
method: "PUT",
headers: {
"Content-Type": "application/json",
Authorization:
Bearer sometoken,},
body: JSON.stringify({
address: owner,
raffle: raffleID,
updateType: "FROM_NULL",
}),
});
when I log this on the route, the Authorization is not even there in the headers... how am I supposed to protect serverless functions if I cant pass a token? Whats wrong here? Thank you
3 Replies
you should not expose API keys, tokens or whatever that protect API endpoints to client side JavaScript, as they are not encrypted, which means everybody can locate and extract the keys, thus does not make sense.
you can use Auth.js to protect Next.js server endpoints such as middleware, API router, server components, and server actions.
another quick and dirty solution to limit particular party, is to make your host name long random characters like
https://dog-cat-0001-mountain-23456-river.foo.com
https://dog-cat-0001-mountain-23456-river.foo.com