[Issue]: Nextjs token based auth is not secure about wundergraph

[Pagebakers]

Have you enabled authentication on all your operations?

https://docs.wundergraph.com/docs/wundergraph-operations-ts-reference/configure-authentication

[bart-sofomo]

@Pagebakers obviously I did:

operations: {
    defaultConfig: {
      authentication: {
        required: true,
      },
    },

I think I know what is missing in the tutorial. Basically the NEXTJS_URL/api/wg/* is secured but when I directly call WUNDERGRAPH_URL/operations without the rewrite in NEXTJS -> that's when it's get tricky. When you do that you an put any kind of token like Beared xyz and wundergraph would still response because it is getting 200 and {} from /api/auth/session.

[Pagebakers]

Thanks for the extra info. In that case the /api/auth/session response should throw an error in case the token is invalid. I'llr un some tests to verify this is broken.

[Pagebakers]

I've tested it, and indeed requests are always accepted because the session endpoint doesn't throw an error when the session isn't valid.

You can create a new userInfo.ts handler in api/auth/userInfo.ts with the following code:

import { getToken } from 'next-auth/jwt';

export default async (req, res) => {
	// If you don't have NEXTAUTH_SECRET set, you will have to pass your secret as `secret` to `getToken`
	const token = await getToken({ req });
	if (token) {
		res.status(200);
		res.json({ name: token.name, email: token.email, picture: token.picture });
	} else {
		// Not Signed in
		res.status(401);
	}
	res.end();
};

And then update the userInfoEndpoint in wundergraph.config.ts to point to the userInfo handler instead.

This way you can also map nextauth user details to the wundergraph claims.

[Pagebakers]

Docs have been updated, closing this for now.