Intro
Wappler allows you to protect Node.js pages using server-side security. Access control is enforced before the page is rendered, ensuring that unauthorized users cannot access protected content.
Security can be applied to:
- Layout pages
- Individual content pages
Page protection works together with Security Providers defined in Server Connect. Once a provider is configured, it can be selected directly in the page settings.
Server Side
Before protecting pages, a Security Provider must be defined in Server Connect.
In this example, the Security Provider is called security.
This provider uses Database Users for authentication and has two permission levels defined:
The configured permission levels will be available when applying page-level protection.
Page Setup
The next step is to apply access restrictions to your pages.
You can restrict access:
- To specific permission levels
- To any authenticated user
- Or leave the page public
If security is applied to a layout page, all content pages using that layout will inherit the same protection settings.
Alternatively, you can apply restrictions directly to individual content pages. This allows different access levels to be configured per page.
In this example, protection will be applied on the layout page so that all content pages using this layout are secured.
Open your layout page:
Then click App in the App Structure panel to access the page-level settings:
Scroll to the Page Security section:
Change Access to Restricted to protect the page.
When applied on a layout page, all content pages using this layout will be protected as well:
Once restricted, the following settings become available:
- Provider — the Security Provider to use for authentication
- Permissions —
Anyor the specific permission levels defined in the provider .Anyallows access to any authenticated user - Login URL — redirect for users who are not logged in
- Forbidden URL — redirect for users without the required permissions
After configuring the security settings, save the layout page.
The selected Security Provider and access rules will now be enforced on all content pages using this layout.
Users who are not authenticated will be redirected to the login page, and users without the required permissions will be redirected to the forbidden page.
Your layout is now protected with server-side security.