Kind: Constant
Source: atloria-monorepo/apps/web/src/app/reader-api/[...path]/route.ts
WEB-4 phase 1 — same-origin reader → public-API proxy.
The reader (on any docs origin) calls /reader-api/<public-path> instead of the
cross-origin public API. This handler runs on the web server, reads the httpOnly
reader-token cookie (set by /reader-api/session), attaches it to the upstream call
as the X-Atloria-Reader-Token header, and streams the response back — so the token
never reaches browser JS. Absent cookie → forwarded unauthenticated (non-gated docs
still work).
The reader passes the project id it already knows via the x-reader-project header
(a public id, not a secret) so the proxy can select the right per-project cookie.
Dormant until NEXT_PUBLIC_READER_COOKIE_AUTH is on and the reader routes through it.
Was this page helpful?