Admin authentication

T

TimTim•1/15/25, 5:24 PM

You can check their role at the level of the page you want to display only to admin role users. If they're not an admin, redirect them to another page.

Something like this

const ProtectedPage = () => {
  const { data: session, status } = useSession();
  const router = useRouter();

  // If session is loading, display a loading indicator
  if (status === "loading") {
    return <p>Loading...</p>;
  }

  // If there's no session or the user role is not "user", redirect to unauthorized
  if (!session || session.user?.role !== "user") {
    router.push("/unauthorized");
    return null; // Prevents rendering protected content
  }

  return (
    <div>
      <h1>Welcome to the Protected Page</h1>
      <p>Your role: {session.user.role}</p>
    </div>
  );
};

const ProtectedPage = () => {
  const { data: session, status } = useSession();
  const router = useRouter();

  // If session is loading, display a loading indicator
  if (status === "loading") {
    return <p>Loading...</p>;
  }

  // If there's no session or the user role is not "user", redirect to unauthorized
  if (!session || session.user?.role !== "user") {
    router.push("/unauthorized");
    return null; // Prevents rendering protected content
  }

  return (
    <div>
      <h1>Welcome to the Protected Page</h1>
      <p>Your role: {session.user.role}</p>
    </div>
  );
};

const ProtectedPage = () => {
  const { data: session, status } = useSession();
  const router = useRouter();

  // If session is loading, display a loading indicator
  if (status === "loading") {
    return <p>Loading...</p>;
  }

  // If there's no session or the user role is not "user", redirect to unauthorized
  if (!session || session.user?.role !== "user") {
    router.push("/unauthorized");
    return null; // Prevents rendering protected content
  }

  return (
    <div>
      <h1>Welcome to the Protected Page</h1>
      <p>Your role: {session.user.role}</p>
    </div>
  );
};

const ProtectedPage = () => {
  const { data: session, status } = useSession();
  const router = useRouter();

  // If session is loading, display a loading indicator
  if (status === "loading") {
    return <p>Loading...</p>;
  }

  // If there's no session or the user role is not "user", redirect to unauthorized
  if (!session || session.user?.role !== "user") {
    router.push("/unauthorized");
    return null; // Prevents rendering protected content
  }

  return (
    <div>
      <h1>Welcome to the Protected Page</h1>
      <p>Your role: {session.user.role}</p>
    </div>
  );
};

O

oreq•1/15/25, 6:19 PM

@şiar_619 If you want to do this TimTim way on server side layout, remember to add additional check on every children page or you gonna leak data.

Ş

şiar_619•1/22/25, 10:43 PM

how can i block them to acces every one of them with only one code block. i mean can i block every unauthorized user from accesing paths starting with /admin

Şşiar_619 how can i block them to acces every one of them with only one code block. i mean...

Y

Y7YA•1/23/25, 1:01 AM

You can use a layout under the admin folder and make it render nothing/error page on unauthorisation. Or write middleware to redirect unuathorised users.

YY7YA You can use a layout under the admin folder and make it render nothing/error pag...

O

oreq•1/23/25, 2:23 PM

and don't use layouts for server side auth

https://www.youtube.com/watch?v=EGDD0rlBd8Q

YouTubeJolly Coding

STOP using Layouts for Authentication!

Layouts combined with Server Components are awesome, and allow us to make database calls right from out components. However, there is a common pitfall with them when it comes to how we think of their rendering order. This is critical if you are trying to hide specific content using a layout check, as you may find the content can still be exposed...

Ooreq and don't use layouts for **server** side auth https://www.youtube.com/watch?v=...

Y

Y7YA•1/23/25, 5:07 PM

I agree with not using layout redirects but I don't think there's a major issue of rendering an unauthorised component in place of the protected content.

Y

Y7YA•1/23/25, 5:09 PM

User requests unauthorised content -> user receives a layout of an unauthorised component unrelated to any sensitive components

Ş

şiar_619•1/27/25, 8:02 PM

i wrote the middleware and tried it but even if i logged in with an ADMIN rolled user it still does not let me access to admin pages. i think there is a problem with my tokens. here is my middleware and config files. an you help me out?

YY7YA You can use a layout under the admin folder and make it render nothing/error pag...

Ş

şiar_619•1/29/25, 1:31 PM

hey i used middleware and it works for localhost but when i deploy it on vercel it doesn't work

Ş

şiar_619•1/29/25, 1:32 PM

i think there is a problem with token

Similar Threads

Similar Threads

Similar Threads