Next.js Discord

Discord Forum

is this safe way to check user type ?

Answered
Japanese common catfish posted this in #help-forum
Open in Discord
Japanese common catfishOP
is this safe way to check user type ?
and render something for admin only ?

import auth from '@/helper/auth'
import { getServerSession } from 'next-auth'
import { redirect } from 'next/navigation'

// admin/dashboard
const DashboardAdmin = async () => {
    const session = await getServerSession(auth)

    if (session.user.type !== "admin") {
        redirect("/")
        return
    }

  await connectDB();

// do something
Answered by B33fb0n3
they can't change it, yea. That's because the jwt is signed and maybe encrypted. Only one with the server secret can change it. The client does not have the server secret, so you are save
View full answer

5 Replies

@B33fb0n3 looks good for me 👍
Japanese common catfishOP
so a bad actor can't change user.type ?
@Japanese common catfish so a bad actor can't change user.type ?
B33fb0n3
they can't change it, yea. That's because the jwt is signed and maybe encrypted. Only one with the server secret can change it. The client does not have the server secret, so you are save
Answer
Japanese common catfishOP
thank you i am new to auth thing
i am learing this
B33fb0n3
sure thing