From 9fbd1034c2d84c52d485b827fe66270d5937b245 Mon Sep 17 00:00:00 2001 From: Max Peintner Date: Thu, 1 Dec 2022 11:25:17 +0100 Subject: [PATCH] docs(NextJS): use auth method basic for guides (#4802) * docs: nextjs using code with auth method basic * Update docs/docs/examples/login/nextjs-b2b.md Co-authored-by: Florian Forster Co-authored-by: Florian Forster --- docs/docs/examples/login/nextjs-b2b.md | 3 ++- docs/docs/examples/login/nextjs.md | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/docs/examples/login/nextjs-b2b.md b/docs/docs/examples/login/nextjs-b2b.md index 51a2e4fdb..70a325c97 100644 --- a/docs/docs/examples/login/nextjs-b2b.md +++ b/docs/docs/examples/login/nextjs-b2b.md @@ -34,7 +34,8 @@ Open the Console (`https://{YourDomain}.zitadel.cloud/ui/console/projects`) and Then on the project detail page click on new application and enter a name for this app. Let's call this one `portal-web`. -Select `Web`, continue, `PKCE`, then enter `http://localhost:3000/api/auth/callback/zitadel` for the redirect, and `http://localhost:3000` for the post redirect. Then press on `create`. +Select `Web`, continue, `CODE`, then enter `http://localhost:3000/api/auth/callback/zitadel` for the redirect, and `http://localhost:3000` for the post redirect. Then press on `create`. +Because the requests from your NextJS application to ZITADEL are made on the server side, you can safely select `CODE`. With this you still get a secret which is then usable alongside PKCE. Your secret never gets exposed on the browser since it is kept in your NextJS server. Copy the "Resource Id" of the project `Portal` as you will need this in your environment configuration file later. diff --git a/docs/docs/examples/login/nextjs.md b/docs/docs/examples/login/nextjs.md index e3decfb59..b0aaf8d6a 100644 --- a/docs/docs/examples/login/nextjs.md +++ b/docs/docs/examples/login/nextjs.md @@ -31,6 +31,7 @@ You will need to provide some information about your app. Navigate to your Project, then add a new application at the top of the page. Select Web application type and continue. We recommend you use [Authorization Code](../../apis/openidoauth/grant-types#authorization-code) in combination with [Proof Key for Code Exchange (PKCE)](../../apis/openidoauth/grant-types#proof-key-for-code-exchange) for all web applications. +As the requests from your application to ZITADEL are made on NextJS serverside, you can select `CODE` in the next step. This makes sure you still get a secret which is then used in combination with PKCE. Note that the secret never gets exposed on the browser and is therefore kept in a confidential environment. ![Create app in console](/img/nextjs/app-create.png)