Validating signed in users in server routes

[robokozo]

The following seems to work but

1. I don't know if this is already abstracted somehow and easier to accomplish
2. I'm not sure its totally secure

//app.vue
const response = await $fetch("/api/foo", {
    headers: useRequestHeaders(['cookie'])
})

//api/foo.ts
import { decodeSessionCookie, ensureAdminApp, AUTH_COOKIE_NAME } from "vuefire/server"

export default defineEventHandler(async (event) => {
  const app = ensureAdminApp()
  const cookie = getRequestHeader(event, "cookie")
  const jwt = cookie?.replace(`${AUTH_COOKIE_NAME}=`, "")
  const user = await decodeSessionCookie(jwt, app)

  //do the stuff that requires auth

  return {}
})

So what do you think? Do you have any suggestions or alternative ideas for getting the user validated on the server?

[robokozo]

Noticed this thread: #1395