24 Replies
This should handle navigating away if the user isn't authenicated just fine, assuming your auth logic is correct. I assume you don't want to hide everything until auth is complete?
I have a main context wrapping the entire thing, that has a fancy spinny mcbob
Ah ic
I think you can remove the
path=""
for the layoutsAnd the SystemContextProvider could be put on the
/system
routeOh, really?
Yeah path should be optional
So build a new context to be specific?
Nah just like
<Route path="/system" component={SystemContextProvider}>
System context on the system routeAaaa
aaa OK I see it
that saves a nest
Not sure if it's important to you but this setup won't prevent the admin-only javascript from being publically accessible
Yeah that is also on my list
Ah
That's the hard part haha
I'm not sure how that is done
Yeah afaik there's not really a good solution for it and imo it's not necessary
I have the backend checking session creds with every request action
Its like a little experimental micro RPC thing I've got going on here 😆
Is part of your project's security requirements that even admin-only UI code can't be accessed publically?
It's a side project honestly, to learn production solidjs. So it would be nice to know of methods
My thinking is I could bake in a session cookie value check into the onMount of the
RequireAdminContextProvider
I'm leaning heavily into the backend receiving credentials over fetch and verifying them...I'm not aware of methods to do so but the common practice is to just host all client JS - including admin UI - publically, and then make sure that your backend is properly authorised, as it sounds like you're already doing
Yeah, I have it going to an async Python web framework that checks the auth on request
using vite to compile
Requiring authorization to load specific chunks of JS is way harder and would need bundler integration or foregoing the bundler for sensitive files entirely so that you can serve them separately
I guess I could split the admin routes from the user routes
Yeah that's where my thoughts went there
https://github.com/CheeseCake87/vite-transporter
Also solid router basically requires that you load the entire route config upfront, so if you wanted to hide the admin route schema you might have a bad time
I put that together with the purpose of sectioning off the js
Which uses the template engine in Flask/Quart to load entire vite apps
.. but sectioning areas was the thought behind that