SupabaseS
Supabase•12mo ago
Zero

Best practices to protect routes if sign out fails?

Here is my callback after signing in/up with Google is successful. For context, only admins can sign in to the app, however since I am using google, normal users (who know the route) can sign in/up. Therefore, to protect my admin routes, I have a table of admins, and after a sign in/up is successful, I will check if their user id is in the admins table. If not, I will sign them out. My concern here is that what if my sign out fails? If they are still signed in they will now be able to access the admin routes.

export const GET = async (request: Request) => {
  const { searchParams, origin } = new URL(request.url)
  const code = searchParams.get('code')
  // if "next" is in param, use it as the redirect URL
  const next = searchParams.get('next') ?? '/'

  if (code) {
    const supabase = await createClient()
    const { error } = await supabase.auth.exchangeCodeForSession(code)
    if (!error) {
      const {
        data: { user },
        error: userError,
      } = await supabase.auth.getUser()

      if (!user || userError) {
        console.error('User is null or an error occurred')
        // Unfinished code
        const { error: signOutError } = await supabase.auth.signOut()
      }
      const admin = await getAdminByUserId(user!.id)

      if (!admin) {
        // Unfinished code
        await supabase.auth.signOut()
        return NextResponse.redirect(`${origin}`)
      }
      
      const forwardedHost = request.headers.get('x-forwarded-host') // original origin before load balancer
      const isLocalEnv = process.env.NODE_ENV === 'development'
      if (isLocalEnv) {
        return NextResponse.redirect(`${origin}${next}`)
      } else if (forwardedHost) {
        return NextResponse.redirect(`https://${forwardedHost}${next}`)
      } else {
        return NextResponse.redirect(`${origin}${next}`)
      }
    }
  }

  // return the user to an error page with instructions
  return NextResponse.redirect(`${origin}/auth/auth-code-error`)
}
Was this page helpful?