https://github.com/hzhu/node-provider-jwt

🔐 Node provider protection with JWTs in frontend dapps
https://github.com/hzhu/node-provider-jwt

alchemy dapp ethereum jwt quicknode-rpc

Last synced: 17 days ago
JSON representation

🔐 Node provider protection with JWTs in frontend dapps

• Host: GitHub
• URL: https://github.com/hzhu/node-provider-jwt
• Owner: hzhu
• Created: 2024-10-13T04:05:59.000Z (about 1 month ago)
• Default Branch: main
• Last Pushed: 2024-10-27T06:30:40.000Z (23 days ago)
• Last Synced: 2024-10-28T08:23:45.313Z (22 days ago)
• Topics: alchemy, dapp, ethereum, jwt, quicknode-rpc
• Language: TypeScript
• Homepage: https://node-provider-jwt-alpha.vercel.app/
• Size: 300 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Node Provider Protection with JWTs in Frontend dApps

[![Medium](https://img.shields.io/badge/Medium-12100E?style=for-the-badge&logo=medium&logoColor=white&style=flat-square)](https://medium.com/@henballs/protecting-node-provider-urls-for-frontend-dapps-c9a8159fc94d)

[![Medium](https://img.shields.io/badge/Vercel-000000?style=for-the-badge&logo=vercel&logoColor=white&style=flat-square)](https://node-provider-jwt-alpha.vercel.app)

  

    

  


  




This project demonstrates how to protect node provider API keys (e.g., for services like Alchemy) in frontend dApps using JWTs. By leveraging short-lived JWTs and refresh tokens, we can securely manage access to node providers without exposing API keys directly in the frontend. For a detailed explanation, check out the [blog post](https://medium.com/@henballs/protecting-node-provider-urls-for-frontend-dapps-c9a8159fc94d) here, and see the solution in action in the [demo app](https://node-provider-jwt-alpha.vercel.app).

## Features

- JWT Generation: Securely generate short-lived JWTs on the server.

- Token Refresh: Automatically refresh tokens before expiration to maintain user sessions.

- Middleware Integration: Handle refresh tokens using Next.js middleware.

- Edge Runtime Ready: Uses the jose package, which is optimized for edge runtimes.

- Secure HTTP-Only Cookies: Store refresh tokens securely using HTTP-only cookies to protect against JavaScript access and cross-site attacks.

## Getting Started

Follow these steps to set up the project locally:

### Prerequisites

- Node.js

- [bun](https://bun.sh)

### Environment Variables

Create a `.env` file in the root of the project and add the following environment variables. You can find the explanations for these variables in the [blog post](https://medium.com/@henballs/protecting-node-provider-urls-for-frontend-dapps-c9a8159fc94d).

```bash

ALCHEMY_PRIVATE_KEY_PKCS8=

ALCHEMY_KEY_ID=

REFRESH_TOKEN_SECRET=

NEXT_PUBLIC_WC_PROJECT_ID=

```

### Development Server

To run the application locally, run:

```bash

bun install

bun run dev

```