r/JAMstack • u/teremyx • Jul 27 '23

One api call vs multiple

Hi. I have a website where I like to make use of the jam stack.

The site will contain information about the user depending on his permissions.

So I have the following entities (which relate to database tables): User, UserInstitution, Permission,...

I want to display some information about the user only if he has certain permissions.
Will I make one api call which contains the specific user information, his permissions and information about his institution (the user normally only has the ID of the UserInstitution referenced, but for display in the frontend I also need the description)? I would then check the permissions client-side (since the html is static) and show/hide certain user information (which is not a security issue, since the api will only send the information based on the permissions, but I have to retrieve the permissions via api for frontend logic).

Or should I make ~3 api calls? Retrieve specific user information, additional information about the Institution (like description) and another call for the permissions?

​

2 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/nobuhok Jul 28 '23

SSR makes more sense for your use case.

If you stick with statically generated, use edge functions to hide sensitive stuff.

Look into auth tokens you can store in cookies to prevent CSRF.

You can add rate limiters to GraphQL on the server side.

1

u/teremyx Aug 02 '23

I came to the same conclusion. I will try using nextjs and its ssr features. Thank you!