NodeJS - Does Security Restrict Redirect from SC?

What is selected in App Structure for you?
There should be a content page properties section in the Properties panel when on the content page and App is selected:

I’m clicking on App, but I think the issue is that the Wappler include doesn’t exist on my pages?

Maybe I’m not remembering this correctly, but I’m sure I saw a bug report about this ages ago. I just created a new content page and the include is there and I see the content page properties on it, but obviously, it doesn’t exist on my older pages.

So I’m now in the process of manually copying this over to all my other pages to get it to show. I would’ve never known these properties were meant to exist, so thanks for that.

Hi Teodor,

So, I’ve set up another one of my Server Connect Actions without the Security Provider and only the Restrict.

What this action does is calculates fees through a custom module of mine. I click a button, and the fees are calculated and returned. All done through a Server Connect element.

In the following GIF, I have already invalidated the session by saving a file in Wappler. I try to run the SC, and it rightly doesn’t run but comes back with a 302 Found status. Then you see the /public route returned in the Fetch/XHR as stated in my restrict. As you’ll see, there is no browser redirection. Only that it returns the HTML from the route.

Below is what the same page looks like in a valid session.

The Server Connect action that this refers to:


So my question is that if a session becomes invalidated for whatever reason, and a SC is loaded, the Server Connect action will not redirect because it’s through a Server Connect Component? Thus actually NEEDING to set up a Dynamic Event on the SC Component for Unauthorized etc to get a redirection.


I will add that the Server Side Data is set on the page to my userDetails SC Action, and trying to navigate to the page with an invalid session does redirect to the /public route.

USER DETAILS ACTION

Page Server Side Data

image

Yes, it will only redirect your actual page when the server action is used in the Server Side Data section of your content page. For other server actions included on the page you don’t need the redirect urls entered in the restrict step.

Potential feature request, or is this not a possibility?

I don’t think that is possible, because of the way server action is included on the page(s).
But why don’t you create a restrict server action which checks the login/user data and use in the Server Side Data on your page? When the user is not logged in then he won’t ever see the page, but will be redirected to the login/unauthorized page.

I suppose 99% of the time, a user’s session invalidating will be login timeout, which I haven’t even looked into yet. So for the time being, I’ll have to add dynamic bindings to those SC components I have that are not autoloaded, but user initiated.

This seems like a perfect use case for:

Set up default redirects when forbidden/unauthorised, show errors when something fails…

1 Like