Add a function to fetch auth user from cookies on the server side

Is your feature request related to a problem? Please describe. I am trying to authenticate requests that come into my Next.js API routes, however, I am not able to pass the token from the useAuthUser hook into the Authorization header. This means that I cannot easily tell if a request is authenticated for my API routes.

Describe the solution you’d like and how you’d implement it It would make it very easy to achieve this if there was a function to get the AuthUser from the backend by passing in the req object. This would behave similarly to the setAuthCookies function that currently exists.

Alternatively (or additionally), I think it would be a great addition to have function wrappers that one can wrap their API Route handlers in, similar to withAuthUserTokenSSR but specifically focused for server-side API Routes.

Is this a breaking change? No, this would not be a breaking change.

Describe alternatives you’ve considered As far as I can tell, the only alternatives are to write custom logic to read and parse the cookies myself. This seems like a very brittle solution since it will break if the structure of the cookies used by this library will break.

Additionally, I have tried to use the method shown in examples of setting the Authorization header, however, for my use case this is not a viable option.

As far as I can tell, I do not think that this change would require significant changes from this library. I think exposing two functions (possible called getAuthUserFromCookies and withAuthUserTokenAPI or something similar), would solve my use case and greatly expand the functionality and flexibility of this library.

I have really enjoyed porting my own Firebase authentication scheme to this library, however, this is a significant challenge now for me. I’m happy to answer any further questions or possibly contribute as well.

[zaverden]

for those how want to rely on cookie and not send token in headers there is a simple helper:

import { withAuthUserTokenSSR } from 'next-firebase-auth'

const checkServerSideAuth = typeof window !== 'undefined'
  ? null // "withAuthUserTokenSSR" can only be called server-side.
  : withAuthUserTokenSSR({
      whenAuthed: AuthAction.RENDER,
      whenUnauthed: AuthAction.REDIRECT_TO_LOGIN,
      authPageURL: '401',
    })(({ AuthUser }) => ({ AuthUser, props: {} }))

export function withAuthUserTokenAPI(handler) {
  return async (req, res) => {
    const { AuthUser, redirect } = await checkServerSideAuth({ req, res })
    if (redirect) {
      res.status(401).json({ ok: false, code: 'unauthorized' })
      return
    }
    return handler(req, res, AuthUser)
  }
}

and then you wrap your API handler:

export default withAuthUserTokenAPI((req, res, user) => {
  // your code here
})

[zaverden]

@Rykuno for the first error just add async for a callback

-     })(({ AuthUser }) => ({ AuthUser, props: {} }))
+     })(async ({ AuthUser }) => ({ AuthUser, props: {} }))

for the second one - next-firebase-auth has wrong TS typings for withAuthUserTokenSSR (at least for 1.0.0-canary.5 and earlier), that’s why there is an error. I suggest to ignore it until typings are fixed. Use @ts-expect-error here

+    // @ts-expect-error wrong typings in lib. remove expect-error if typings are correct now
     const { AuthUser, redirect } = await checkServerSideAuth({ req, res });

Here is typed version: https://gist.github.com/zaverden/9f6579f262ac25b591dd814047e19b30