You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -215,11 +215,11 @@ In this example, if the incoming request is not associated with a valid user ses
215
215
216
216
</Callout>
217
217
218
-
### (Preview) Perform authentication on the server side and enable HTTP-only cookies
218
+
### (Experimental) Perform authentication on the server side and enable HttpOnly cookies
219
219
220
220
<Calloutwarning>
221
221
222
-
**NOTE:** Once you enable the server-side sign-in feature, auth tokens are stored in HTTP-only cookies and you may not change the HTTP-only attribute. Since these cookies are inaccessible from client-side scripts, you won’t be able to use any Amplify JS APIs on the client side. Therefore, you don’t need to configure Amplify on the client side.
222
+
**NOTE:** Once you enable the server-side sign-in feature, auth tokens are stored in HttpOnly cookies and you may not change the HttpOnly attribute. Since these cookies are inaccessible from client-side scripts, you won’t be able to use any Amplify JS APIs on the client side. Therefore, you don’t need to configure Amplify on the client side. You can keep using [these Amplify JS server-side APIs](/[platform]/build-a-backend/server-side-rendering/#supported-apis-for-nextjs-server-side-usage) on the server side.
223
223
224
224
</Callout>
225
225
@@ -228,33 +228,33 @@ In this example, if the incoming request is not associated with a valid user ses
228
228
To authenticate users on the server side, you must enable either Amazon Cognito Managed Login or Hosted UI in your Amazon Cognito User Pool client.
229
229
230
230
231
-
**Step 1 - Specify the origin of your app in environment variables**
231
+
#### Step 1 - Specify the origin of your app in environment variables
232
232
233
233
Add the following environment variables to your Next.js app. For example in a `.env` file:
234
234
235
-
```shell title=".env"
235
+
```shell title=".env" showLineNumbers={false}
236
236
AMPLIFY_APP_ORIGIN=https://myapp.com
237
237
```
238
238
239
239
Ensure this environment variables is accessible in your Next.js app's server runtime.
240
240
241
241
> **Note:** Token cookies are transmitted via server-side authentication flows. In production environments, it is recommended to use HTTPS as the origin for enhanced security.
242
242
243
-
**Step 2 - Export the `createAuthRouteHandlers` function**
243
+
#### Step 2 - Export the `createAuthRouteHandlers` function
244
244
245
245
The `createAuthRouteHandlers` function is created by the `createServerRunner` function call when you configure Amplify for server-side usage. You can export this function from your `amplifyServerUtils.ts` file. You can also configure cookie attributes with the `runtimeOptions` parameter.
Create an API route using the `createAuthRouteHandlers` function. For example:
273
273
@@ -302,15 +302,15 @@ With the above example, Amplify generates the following API routes:
302
302
|`/api/auth/sign-in`| Upon navigating an end user to this route, they’ll be redirected to the Amazon Cognito Managed Login sign-in form. After sign-in, they’ll be redirected back to the route `/api/auth/sign-in-callback`. |
303
303
|`/api/auth/sign-in?provider=<social-provider-name>`| Upon navigating an end user to this route, they’ll be redirected to first to the Amazon Cognito Managed Login and then the specified social provider sign-in page. After sign-in, they’ll be redirected back to the route `/api/auth/sign-in-callback`. |
304
304
|`/api/auth/sign-out`| Upon navigating an end user to this route, the end user will be signed out and redirected to the route `/api/auth/sign-out-callback`. |
305
-
|`/api/auth/sign-in-callback`| Amazon Cognito Managed Login redirects an end user back to this route after signing in. Amplify exchanges auth tokens and stores them as HTTP-only cookies in the browser cookie store, then redirects the end user back to the route specified by the `redirectOnSignInComplete` parameter. |
305
+
|`/api/auth/sign-in-callback`| Amazon Cognito Managed Login redirects an end user back to this route after signing in. Amplify exchanges auth tokens and stores them as HttpOnly cookies in the browser cookie store, then redirects the end user back to the route specified by the `redirectOnSignInComplete` parameter. |
306
306
|`/api/auth/sign-out-callback`| Amazon Cognito Managed Login redirects an end user back to this route after signing out, Amplify revokes access token and refresh token and removes token cookies from browser cookie store, then redirects the end user back to the route specified by the `redirectOnSignOutComplete` parameter. |
307
307
308
308
> **Note:** A signing-out call involves multiple steps, including signing out from Amazon Cognito Managed Login, revoking tokens, and removing cookies. If the user closes the browser during the process, the following may occur:
309
309
>
310
310
> 1. auth token have not been revoked - user remains signed in
311
311
> 2. auth token have been revoked but cookies have not been removed - cookies will be removed when the user visits the app again
312
312
313
-
**Step 4 - Provide the redirect URLs to the Auth Resource in Amplify**
313
+
#### Step 4 - Provide the redirect URLs to the Auth Resource in Amplify
314
314
315
315
You can provide the callback API routes as the redirect URLs in the Auth resource configuration. For example:
@@ -217,11 +217,11 @@ In this example, if the incoming request is not associated with a valid user ses
217
217
218
218
</Callout>
219
219
220
-
### (Preview) Perform authentication on the server side and enable HTTP-only cookies
220
+
### (Experimental) Perform authentication on the server side and enable HttpOnly cookies
221
221
222
222
<Calloutwarning>
223
223
224
-
**NOTE:** Once you enable the server-side sign-in feature, auth tokens are stored in HTTP-only cookies and you may not change the HTTP-only attribute. Since these cookies are inaccessible from client-side scripts, you won’t be able to use any Amplify JS APIs on the client side. Therefore, you don’t need to configure Amplify on the client side.
224
+
**NOTE:** Once you enable the server-side sign-in feature, auth tokens are stored in HttpOnly cookies and you may not change the HttpOnly attribute. Since these cookies are inaccessible from client-side scripts, you won’t be able to use any Amplify JS APIs on the client side. Therefore, you don’t need to configure Amplify on the client side. You can keep using [these Amplify JS server-side APIs](/gen1/[platform]/build-a-backend/server-side-rendering/nextjs/#supported-apis-for-nextjs-server-side-usage) on the server side.
225
225
226
226
</Callout>
227
227
@@ -230,19 +230,19 @@ In this example, if the incoming request is not associated with a valid user ses
230
230
To authenticate users on the server side, you must enable either Amazon Cognito Managed Login or Hosted UI in your Amazon Cognito User Pool client.
231
231
232
232
233
-
**Step 1 - Specify the origin of your app in environment variables**
233
+
#### Step 1 - Specify the origin of your app in environment variables
234
234
235
235
Add the following environment variables to your Next.js app. For example in a `.env` file:
236
236
237
-
```shell title=".env"
237
+
```shell title=".env" showLineNumbers={false}
238
238
AMPLIFY_APP_ORIGIN=https://myapp.com
239
239
```
240
240
241
241
Ensure this environment variables is accessible in your Next.js app's server runtime.
242
242
243
243
> **Note:** Token cookies are transmitted via server-side authentication flows. In production environments, it is recommended to use HTTPS as the origin for enhanced security.
244
244
245
-
**Step 2 - Export the `createAuthRouteHandlers` function**
245
+
#### Step 2 - Export the `createAuthRouteHandlers` function
246
246
247
247
The `createAuthRouteHandlers` function is created by the `createServerRunner` function call when you configure Amplify for server-side usage. You can export this function from your `amplifyServerUtils.ts` file. You can also configure cookie attributes with the `runtimeOptions` parameter.
248
248
@@ -269,7 +269,7 @@ export const {
269
269
});
270
270
```
271
271
272
-
**Step 3 - Set up the Auth API routes**
272
+
#### Step 3 - Set up the Auth API routes
273
273
274
274
Create an API route using the `createAuthRouteHandlers` function. For example:
275
275
@@ -304,15 +304,15 @@ With the above example, Amplify generates the following API routes:
304
304
|`/api/auth/sign-in`| Upon navigating an end user to this route, they’ll be redirected to the Amazon Cognito Managed Login sign-in form. After sign-in, they’ll be redirected back to the route `/api/auth/sign-in-callback`. |
305
305
|`/api/auth/sign-in?provider=<social-provider-name>`| Upon navigating an end user to this route, they’ll be redirected to first to the Amazon Cognito Managed Login and then the specified social provider sign-in page. After sign-in, they’ll be redirected back to the route `/api/auth/sign-in-callback`. |
306
306
|`/api/auth/sign-out`| Upon navigating an end user to this route, the end user will be signed out and redirected to the route `/api/auth/sign-out-callback`. |
307
-
|`/api/auth/sign-in-callback`| Amazon Cognito Managed Login redirects an end user back to this route after signing in. Amplify exchanges auth tokens and stores them as HTTP-only cookies in the browser cookie store, then redirects the end user back to the route specified by the `redirectOnSignInComplete` parameter. |
307
+
|`/api/auth/sign-in-callback`| Amazon Cognito Managed Login redirects an end user back to this route after signing in. Amplify exchanges auth tokens and stores them as HttpOnly cookies in the browser cookie store, then redirects the end user back to the route specified by the `redirectOnSignInComplete` parameter. |
308
308
|`/api/auth/sign-out-callback`| Amazon Cognito Managed Login redirects an end user back to this route after signing out, Amplify revokes access token and refresh token and removes token cookies from browser cookie store, then redirects the end user back to the route specified by the `redirectOnSignOutComplete` parameter. |
309
309
310
310
> **Note:** A signing-out call involves multiple steps, including signing out from Amazon Cognito Managed Login, revoking tokens, and removing cookies. If the user closes the browser during the process, the following may occur:
311
311
>
312
312
> 1. auth token have not been revoked - user remains signed in
313
313
> 2. auth token have been revoked but cookies have not been removed - cookies will be removed when the user visits the app again
314
314
315
-
**Step 4 - Provide the redirect URLs to the Auth Resource in Amplify**
315
+
#### Step 4 - Provide the redirect URLs to the Auth Resource in Amplify
316
316
317
317
You can run `amplify add auth` or `amplify update auth` to provide the callback API routes as the redirect URLs. See [Configure the Auth category](/gen1/[platform]/build-a-backend/auth/add-social-provider/#configure-the-auth-category) for more details. With the above example, you can provide the following redirect URLs:
0 commit comments