[whoknowsidont]

HN has a very weird mind-set when it comes to JS frameworks.

Next.JS is more than fine for 99% of web apps, and the fit only gets better the bigger your web app/platform. In general it's probably the framework that will give you the most bang for your buck.

[bdangubic]

expect you know, when you can bypass auth by adding an http header :)

[whoknowsidont]

Not that this isn't a serious attack vector (a possible one), but most implementations are not simply using middleware as a standalone check for authorization then blindly serving paths/content up.

That'd be pretty bad architecture in any stack.

[apsurd]

so having "some protections" like db foreign key scoping that mitigates "well anyone can now bypass auth middleware for any route" makes this…

"not that bad on nextjs part"

no no, this is absolutely nuts.

[whoknowsidont]

Some of you are ready for an argument, you responded to my post yet seemingly missed the very first sentence fragment:

>Not that this isn't a serious attack vector

At no point did I say or imply what you put in quotes.

[arandomusername]

I disagree. Why pollute every function with code checking for auth if you can just do it in a middleware?

[jonny_eh]

The middleware should fetch auth, not check it. Each page should check the auth provided by the middleware. Skipping middleware wouldn't bypass anything in this case.

[arandomusername]

If each page has different criteria, sure, but if not, why? Let's say I simply care if the user is a paying member. I don't see why I wouldn't just have that in the middleware.

[whoknowsidont]

You don't do it everywhere. You do it in the source system. The Next.JS application should just be doing "sanity" checks and passing along identity information at most. That belongs in the middleware layer, but it's not authoritative.

If bypassing a middleware layer is the one "trust me bro" check you have in your web app, then lol.

That's actually really hilarious and you should tell me what company/website that's for so I can submit some bug bounties.

[arandomusername]

Isn't next.js the "source system" (or whatever that means) in most cases, since most apps are just next.js + database? I don't use next.js but my understanding is it does both backend and frontend.

You will never bypass middleware on my services because they actually always run. If you can't rely on your middleware then you are using the wrong tech.

I haven't heard any good reason as to why not have auth in your middleware lawyer. Just attempt to shrug it away as a "trust me bro" check. Are if statements trust me bro too? Only thing you shouldn't be doing is using garbage software like next js

From next.js homepage > Middleware > Take control of the incoming request. Use code to define routing and access rules for authentication, experimentation, and internationalization.

[whoknowsidont]

>Isn't next.js the "source system"

Absolutely not. You are pulling from something else. If you need authorization to view a page that means it's more than likely not going to be SSG or ISR, so both the Next.JS application and the source system should be doing authorization checks.

>If you can't rely on your middleware then you are using the wrong tech.

"If you can't rely on server less functions to run"

I mean, I can't help you there if that's your expectation that serverless functions will always run correctly.

>Just attempt to shrug it away as a "trust me bro" check.

If you lose identity and your system just chugs along anyway then there isn't a tech stack in the world that can help you.

>I haven't heard

Because you're being a dense muppet?

[bdangubic]

you probably need to re-define “most” :)

[mattmanser]

That's a bold claim, that's easy to refute.

Next.js is a bad choice for a lot of apps, javascript is slow at a lot of things.

Next.js would be a terrible choice for any app that has any non-trivial compute, for example.

[whoknowsidont]

You said it was easy to refute yet you merely stated a mis-framed, contrarian perspective.

If you're going to try to be pedantic, do it right?

>Next.js would be a terrible choice for any app that has any non-trivial compute

Most web apps only need trivial compute. If you're including back-office, source systems in the word "web app" well that's your sticking point, not mine.

[mattmanser]

How is it pedantic? What is your understanding of that word?

Why do I have to laboriously explain a fairly simple concept? Here you go:

Javascript is a non-compiled language. It is slow, orders of mangitufes slower than other languages such as Go, Rust, C#, Java, etc.

Quick note, you might not understand orders of magnitude. It means 10^n times, so 1 order of magnitude slower is 10x slower, 2 orders of magnitude is 100x, 3 1000x, etc.

A huge percentage of apps need to do decent CPU work, way more than 1%, which Javascript is not appropriate for.

This is HN, you should have rudimentary understanding of the differences between languages.

If you want another example, any app that deals with money, decimals or anything mathematical should not be written on javascript.

Another massive chunk of apps, way more than 1%.

This is because 0.01 + 0.02 is not equal to 0.03 in javascript.

People who don't know why that is really shouldn't be commentating on this topic, they're on Mount Stupid in the Dunning-Kruger Effect curve.

[jazzypants]

Please, show me a single benchmark that shows any other language that is even a single "order of magnitude" faster than JavaScript at literally anything.

It's funny that you put in the effort to condescendingly define orders of magnitude, but you forgot to check to see if you were actually correct before writing out eight paragraphs that made you look like a pompous ass.

Hating JavaScript is just pointless and sad at this point.

[TheCoelacanth]

Most web apps are IO bound, not CPU. JS is just as fast at IO as any other language.

[whoknowsidont]

>Why do I have to laboriously explain a fairly simple concept

I mean, that's on you. You think you're saying something when you're not and you're trying to justify it.

You could just admit you made a mistake and move on with your life.

[rs186]

Wait, how is "JavaScript is slow at a lot of things" (a vague/questionable premise by itself) relevant to the discussion here?