Does Nitro have support for middleware?

[OptimusePrime]

Does Nitro have support for middleware: something similar to Express middleware? If so, how do you define one?

[pi0]

Hi. Yes it does. You have to simply put them into server/middleware directory 🪄

https://v3.nuxtjs.org/guide/features/server-routes#server-middleware

[Shahriar-Rahi]

Yes, here I'm preferring to handle all routes in a single file because I only need these routes to proxy my secret routes. It becomes difficult to proxy huge number of endpoints if we have to create a different file for each endpoint. However, will wait for the fix. Thanks for taking the time to reply :).

[Baloche]

Yup ! We went for a custom defineEventHandler function that we use for the routes we want to protect :

export function defineAuthenticatedEventHandler<T>(
  handler: (event: CompatibilityEvent, user: User) => T | Promise<T>
) {
  return defineEventHandler<T>(async (event) => {
    try {
      const user = await useAuth(event)
      return handler(event, user)
    } catch (err) {
      sendError(event, err)
    }
  })
}

The useAuth method get the user from the current jwt cookie and throw a 401 error if expired or doesn't exists.

Here is the definition of the route used to get the logged in user :

// /server/api/me.get.ts
export default defineAuthenticatedEventHandler((_, user) => {
  return user
})

[pi0]

Nice wrapper method!

[mipruch]

@Baloche Hey! That looks great and I think the code might resolve my problem. Where did you define the function. In composables?

import jwt from "jsonwebtoken";

const secretKey = process.env.JWT_SECRET!;

export function defineAuthenticatedEventHandler<T>(handler: (event: Event) => T | Promise<T>) {
	return defineEventHandler(async (event) => {
		const usersJWT = getHeader(event, "Authorization");
		if (!usersJWT) {
			throw createError({
				statusCode: 401,
				statusMessage: "Unauthorized",
			});
		}

		const hash = usersJWT.split(" ")[1];
		jwt.verify(hash, secretKey!, function (err, decoded) {
			if (err) {
				throw createError({
					statusCode: 401,
					statusMessage: "Unauthorized",
				});
			}
		});
	});
}

And for the API route:

import { defineAuthenticatedEventHandler } from "@/server/services/middleware";

export default defineAuthenticatedEventHandler((event) => {
	return "authorized";
});

But I keep getting this error. The Nuxt doesn't know that that is an API endpoint:

{
    "url": "/api/test",
    "statusCode": 404,
    "statusMessage": "Cannot find any route matching /api/test.",
    "message": "Cannot find any route matching /api/test.",
    "stack": ""
}

[slavanossar]

@mipruch You can put them in server/utils, it's mentioned in the docs here.