How it works

This library adds a password prompt to your Next.js deployment. It consists of two main parts:

1. Two serverless API routes:
   • A login route that checks if a password is correct and sets a cookie with a JWT in case it is.
   • A check route that validates if you have the authorization cookie with a valid JWT.
2. A HOC (Higher-Order Component) that wraps Next.js App and adds a check that validates if you are logged in. If you do, then you can view the app normally; otherwise, you are presented with a password prompt.

Important: The recommended use case for this library is in a staging or preview environment. By taking advantage of webpack's DefinePlugin, we can make sure this library is only included in certain environments, keeping the production bundle size small.

This library is NOT meant as a secure password authentication wrapper, but rather as a way to keep nosey people out.

Installation

yarn add next-password-protect
# or
npm install next-password-protect

Usage

There are 3 steps to enabling password protect: setting a global variable, adding the API routes, and adding the HOC to _app.

Step 1

In order to be able to take advantage of dead code elimination, it is recommended to add an environment variable like process.env.PASSWORD_PROTECT, and enable the library based on that variable. To set this variable, add the following to next.config.js:

module.exports = {
  env: {
    // Add any logic you want here, returning `true` to enable password protect.
    PASSWORD_PROTECT: process.env.ENVIRONMENT === 'staging',
  }
});

Step 2

Add two api routes, one with the loginHandler and one with the passwordCheckHandler api function. You can name them anything, as long as you pass the names to loginApiUrl and checkApiUrl respectively, in the next step. By default it expects /login and /passwordCheck.

import { loginHandler } from "next-password-protect";

export default loginHandler("YOUR_SECRET_PASSWORD", {
  // Options go here (optional)
  cookieName: "next-password-protect",
});

import { passwordCheckHandler } from "next-password-protect";

export default passwordCheckHandler("YOUR_SECRET_PASSWORD", {
  // Options go here (optional)
  cookieName: "next-password-protect",
});

Step 3

Add the withPasswordProtect HOC to the default export of App in pages/_app.tsx:

import { withPasswordProtect } from "next-password-protect";

// Before: export default App;
export default process.env.PASSWORD_PROTECT
  ? withPasswordProtect(App, {
    // Options go here (optional)
    loginApiUrl: "/login",
  })
  : App;

Note: make sure to specify loginApiUrl and/or checkApiUrl if the api route(s) are not default.

API

API routes handlers

loginHandler(password: string, options)

The options object can contain any of the following options:

Option | Description | Default value ------ | ----------- | ------------- cookieMaxAge| Cookie Max-Age attribute | undefined cookieName| The name of the authorization cookie | 'next-password-protect' cookieSameSite| SameSite cookie attribute | false cookieSecure| Secure flag on the cookie | process.env.NODE_ENV === 'production'

passwordCheckHandler(password: string, options)

The options object can contain any of the following options:

Option | Description | Default value ------ | ----------- | ------------- cookieName| The name of the authorization cookie | 'next-password-protect'

Next App HOC

withPasswordProtect(App: NextApp, options)

The options object can contain any of the following options:

Option | Description | Default value ------ | ----------- | ------------- checkApiUrl| Relative path of the api route handled by passwordCheckHandler | '/api/passwordCheck' loginApiUrl| Relative path of the api route handled by loginHandler | '/api/login' loginComponent| Supply your own React component to show as login prompt | LoginComponent loginComponentProps| Properties object to customize the login prompt, without overriding the entire component (see below) | {} bypassProtection| Bypass protection for specific routes, decided by callback with NextRouter param | ({ route }) => false

The loginComponentProps object can contain any of the following options:

Option | Description | Default value ------ | ----------- | ------------- backUrl| Show a link with this URL to go back to main website | undefined buttonBackgroundColor| Login button background color | '#01EDBC' buttonColor| Login button color | '#111' logo | Show a logo above the prompt (img src) | undefined

Advanced

Custom login component

To change the default login component, a React component can be supplied to the withPasswordProtect HOC. In order for the library to function properly, make sure your login component has password input that is validated by the the api route. You can use src/hoc/LoginComponent.tsx as a starting point.

Caveats

AMP is not yet supported, because the LoginComponent failed AMP validation. On an AMP page, nothing is rendered. This could be fixed by changing LoginComponent to valid AMP.