Guide on handling protected SSR api requests

[uptownhr]

A bit tricky of a question but here's the scenario. Also, sorry for posting here if not the correct project. Wasn't sure which repo to post under.

Using Nuxt with Express

• Using Express Sessions
• You have protected routes that lookup session to allow access
• From a Nuxt page component, you use fetch (), or other server side hooks, to hit the protected route for data.

This works without an issue from the browser's point of view as cookie/session can be detected. However, when the fetch hook is triggered from the server, cookie/session is lost. Following the, https://nuxtjs.org/examples/auth-routes/ is insufficient.

ie: if your protected route looks like

exports function(req,res){
  if (!req.session.user) return res.status(401).send('not logged in')
}

Nuxt renderer will throw a 401 error as the hook call to the protected route will not contain the user session.

There are many solutions/workarounds here

• Not using sessions and turning to stateless tokens
• Not calling protected routes from server
• • using isServer flag
• • using the mounted hook instead

There may be others but probably in the realms of either or.

1. The token solution works but is not straight forward and probably be worthwhile to have examples for people to follow and setup.
2. not using protected routes from the server is a simple workaround but limits SSR on protected pages. From an SEO standpoint, this is completely fine and probably the use of SSR in the first place. Still not ideal.

_{This question is available on Nuxt.js community (#c285)}

[pyramation]

this is seemingly still an issue that's not documented? I'm happy I searched and stumbled into a closed issue that looks unresolved - at least I'm not alone ;)

[walter0331]

I just ran into this issue today. and was scratching my head for hours, trying to figure out why express loses session on SSR. :(

[uptownhr]

JUST FYI: I have transitioned to using JWT tokens. Makes it much simpler to not have to deal with sessions.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.