routes.json to protect entire site

Question

Hi, I'm using Azure Static Web Apps and I'm trying to protect an entire site so that all users have to be authenticated (invited and logged in) to be able to open any part of the site.

The routes.json I have right now is:

{
"routes": [
{
"route": "/index.html",
"allowedRoles": ["authenticated"]
},
{
"route": "/*",
"serve": "/index.html",
"statusCode": 200
}
]
}

But that seems to allow anynymous connections still

Can anyone advise?

Thanks!

Answer 1

Hi @Anonymous ,

Thanks for your patience. Routes are secured by adding one or more role names into a rule's allowedRoles array.

based on what you shared, you have "allowedRoles": ["authenticated"] but you don't have an authorization provider-specific login route. for example, You can add a route rule like this

{  
  "route": "/login",  
  "serve": "/.auth/login/github"  
}   

to map a authentication-authorization default provider to a friendly route like /login. See the example route file for details.

Please let us know if you have further questions

Thanks,
Grace

Answer 2

That worked; thanks very much!

I guess to have an authentication page I would make Index.html be a login page with links to login to GMail or Office365 (for example) and then those links would point to the relevant /.auth/login provider in my routes.json?