/_next/**/*.json leaks server side props
Answered
Rex posted this in #help-forum
RexOP
Hello! I have an issue- I'm still using the pages router, and I'm using
What I found was that Nextjs seems to be caching(?) requests that require the getServerSideProps function in this json endpoint. Usually this would not be an issue, except for the fact that this data in particular is extremely sensitive and I have made sure at every step to secure every endpoint I can. This blows a massive hole open in my stack. Anybody who happens to be snooping on my wifi network can see these requests made to the
This is bad. How do I turn this off? How do I circumvent this? I have an idea having to do with diffie-hellman but that seems a little overkill, and ideally I would avoid fetching the data on the client.
getServerSideProps() to grab some data from my database before I give it to my page. This works fine, the actual mechanism of getServerSideProps is working as expected, but I was going through my logs on vercel one day and I saw a bunch of requests to the /_next/ namespace, each ending with a .json. I thought this was odd, as my app doesnt explicitly make any requests for json, and so I visited the URL it was requesting just to see what was there.What I found was that Nextjs seems to be caching(?) requests that require the getServerSideProps function in this json endpoint. Usually this would not be an issue, except for the fact that this data in particular is extremely sensitive and I have made sure at every step to secure every endpoint I can. This blows a massive hole open in my stack. Anybody who happens to be snooping on my wifi network can see these requests made to the
/_next/ namespace and grab the data from there without even having to bypass the security measures I have in place.This is bad. How do I turn this off? How do I circumvent this? I have an idea having to do with diffie-hellman but that seems a little overkill, and ideally I would avoid fetching the data on the client.
8 Replies
RexOP
hm. i could create an api endpoint. would that solve it?
ah well that would really only kick the can further down the road
i create the api endpoint, i fetch either on getServerSideProps or the client, the data is still plaintext.
RexOP
ah.
Answer
RexOP
alright this isnt really solved but i'll have to find some other way of doing it 🙃
o/