Setting Up A Cookie From NEXT.JS Back-end

Sowmo0509 — Wed, 02 Nov 2022 12:43:53 +0000

Hello there, good people! I was literally stuck for a couple of hours on this issue and as a beginner, I am pretty sure most of us will be facing or already faced these kind of cookie setting troubles in NEXT.JS server-side.

To set a cookie, you just need one package, cookie. And remember, serious cookies should be sent from the server. In Express servers, it is pretty easy; just res.cookie() and you are ready to go. But, in NEXT.JS, you can not just use res.cookie() directly as far I am concerned. So, here's a solution instead:

import cookie from "cookie";

// token = your JWT signed token  
res.setHeader("Set-Cookie", cookie.serialize("token", token, COOKIE_OPTIONS));

"token" : the name of the token.
token : jwt signed token, STRING, which will be stored inside the token.
COOKIE_OPTIONS : this is my current cookie option:

const COOKIE_OPTIONS = {
    httpOnly: true,
    secure: process.env.NODE_END !== "development",
    sameSite: "strict",
    maxAge: 3600,
    path: "/",
  };

This is how I stored my cookies.

To remove this cookie:

const COOKIE_OPTIONS = {
    httpOnly: true,
    secure: process.env.NODE_END !== "development",
    sameSite: "strict",
    maxAge: 0, //make sure this is 0
    path: "/",
  };
res.setHeader("Set-Cookie", cookie.serialize("token", "", COOKIE_OPTIONS));

This is how the whole login and logout cookie process works. Thanks! Hope this will help someone like me!

Firebase API Key Security Issue – for Custom Sign Up/Login

Sowmo0509 — Sat, 01 May 2021 08:47:46 +0000

Hello! Hope you're having a good day.

I was working on a project where I am making a user input form with HTML, JavaScript but when I inspect using Google Chrome, the front-end codes are showing up. All of my firebase Realtime Database API, Key, everything is there, visible.

I was wondering, if I make a login/sign up page using firebase and JavaScript, someone will be able to steal this database API and create their own HTML form, submit information and then they come back to my site and directly login with what they have, right?

Is there possibly any way (without React.js .env method) to prevent users from stealing my firebase API codes?

DEV Community: Sowmo0509

Setting Up A Cookie From NEXT.JS Back-end

Firebase API Key Security Issue – for Custom Sign Up/Login