Only expose public data part of session about nuxt-auth-utils HOT 4 OPEN

To avoid breaking changes, I am thinking of having:

setUserSession(event, publicData, privateData)

And only expose the publicData to the endpoint. I need to think about the types though

from nuxt-auth-utils.

For context, the reason why this came up is that I was trying to store private data into the users sessions. Knowing how sessions work, I figured it would be safe to add it there. After all it was only data I needed within a Nitro context.

I missed the comments in the code example from the documentation explaining that the actual logic is that nothing attached to the user sessions is safe. I found it later via the jsdocs while debugging some code. In hindsight it is kind of obvious that this is the only way it could work.

So in reality there is no way to attach private data to the users session (without some workarounds?), which seems like a missed opportunity.

I think:

• data.public is a great idea and solves the original issue.
• we need a dedicated docs section explaining how session data is stored / exposed given how sensitive it is

from nuxt-auth-utils.

Do you already have something in mind? I can have a go at this as I have good use for it.

An easy way is to just have two types and merge them into a single object:

export interface PublicSessionData {
  user?: User
}

export interface PrivateSessionData {
}

// Like this?
export interface SessionData {
  public?: PublicSessionData
  private?: PrivateSessionData
}
// Or this?
export interface SessionData extends PrivateSessionData {
  public?: PublicSessionData
}

and then /api/session.get:

export default eventHandler(async (event) => {
  const session = await requireUserSession(event)

  await sessionHooks.callHookParallel('fetch', session, event)

  return session.public
})

Or we could do some crazy key manipulation in a way that private properties can be filtered out recursively.
But that does not sound like the way to go.

from nuxt-auth-utils.

Can you open a PR with your solution @Gerbuuun ?

from nuxt-auth-utils.