I worked with Next-auth before but I also used the built in next API feature. When used with next API, I can protect my APIs. The problem is now I am using an external node.js API. The token is created in the front end and this leaves my node API endpoints exposed. Is there something I'm missing here? How should I do this? Or tell me if there is a better way. Thanks a lot!
1 Answers
You should not generate any JWT tokens in the frontend as that is way to insecure. Better to work if a dedicated and separate authorization service that generates the token for you. Either you host one your self or use a third party solution like Auth0 to generate the tokens for you.
Today more and more moves towards using the BFF pattern to further secure their SPA applications.
Related