1

I am using nuxt app with express server routes, when I hit login or other api calls it shows in network. and apis are exposed .

I mean if some try it using postman he can get everything he wants.

so the question is > How to secure nuxt app (express routes , axios calls)?

is there any way for @nuxt/auth to not save jwt open in local storage?

Amjid Ali Shah
  • 49
  • 4

1 Answers1

1

There is no need to hide anything regarding the calls on the client-side. Because this is how a front-end framework works (your API routes are not supposed to be hidden either, no need for paranoia).

If you want to provide something secure, you can indeed have a JWT authentication that will be send as a header for all of your axios calls.

More info can be found here. A good thing to know is that it's not likely that somebody will hack your client's browser to get the JWT from their cookies (safer than localStorage) but if you feel like it's a HUGE possibility, bring down the expiration of the token to 1 minute.

Then, you could bring a refresh token alongside your access token to be sure that it's refreshed without asking the user to go through a login page another time.

PS: Some reading on your favorite search engine will be mandatory to understand all the concepts on how to implement a well done JWT flow with your client side app.

kissu
  • 40,416
  • 14
  • 65
  • 133
  • Ok, I am doing like that but being a developer if I put jwt in postman and call to delete users by there ids ,,, I can do that easily but it should not be done like this. do you know what I mean? – Amjid Ali Shah May 19 '22 at 10:42
  • 1
    @AmjidAliShah eh, here it's a permission problem. Somebody who have access to something private should not have the same rights as an admin. Hence, he can delete his own things, not all of your users. Backend logic concern here and common sense. – kissu May 19 '22 at 10:45
  • @AmjidAliShah not sure what all of this is, but comments are not a place for code snippets. Please edit your question. – kissu May 19 '22 at 11:20
  • ok, i put in next questions i think you will get it now – Amjid Ali Shah May 19 '22 at 11:36