Allow root without allowing sub-route

[veeva-cody]

We're running an out of home activation and we need to secure some admin routes with basic auth, but allow the root / and some other sub-routes for the general audience. When we add / to the allowedRoutes array, it makes all routes public.

Is there a way to make the root public without simultaneously opening up the rest of the site?

[Rigo-m]

If you take a look at the underlying code, it just uses a regex.

So if you put '^/$' instead of just '/' you should be good to go

[IsraelOrtuno]

If you take a look at the underlying code, it just uses a regex.

So if you put '^/$' instead of just '/' you should be good to go

This does work but not when the url contains query parameters ?q=foo. Module middleware is checking agains the full path:

https://github.com/kgierke/nuxt-basic-auth/blob/main/src/runtime/server/middleware/basic-auth.ts#L28

I wonder if it could make sense to just compare against the real URI instead. Thoughts?

[Rigo-m]

Reading the whole url gives you more power to, potentially, make a regex however you want.
I'd close the issue anyway, it's a non-issue but just an implementation detail.

[kgierke]

Hi, that's an interesting use case, so far the only option would be as suggested by others to use a regex pattern. Alternatively I could think of implementing a "dissallowRoutes" config option to only protect a list of routes.

Not sure however, when I will have the time to implement that, but PR's are welcome ;)