Server Development in Astro

Server Development is the sixth chapter of the free Astro tutorial. Asha's site starts to remember visitors, accept forms and protect private pages.

What each lesson covers:

  • Endpoints and Server Data: GET and POST functions, JSON and status codes, static and on-demand endpoints, an RSS feed and database code.
  • Middleware and Cookies: onRequest, next(), sequence(), locals, and reading, setting and deleting cookies.
  • Sessions: server-side data per visitor, get() and set(), regenerate() and destroy(), and session drivers.
  • Actions and Forms: defineAction(), Zod input, calling actions from scripts and forms, field errors and ActionError.
  • Authentication: hashed passwords, login and logout, protecting pages in middleware, roles, and 401 vs 403.

The chapter adds server code to an Astro site step by step. Endpoints return JSON or other data from GET and POST functions. Middleware runs before every page, so it can share data through locals and read or set cookies. Sessions store data for each visitor on the server. Actions handle forms with input checked by Zod and clear error messages. The last lesson puts it together into login and logout with hashed passwords, pages that only signed-in users can open, and roles that decide who can do what.

Every lab runs Astro 7's real runtime and middleware in your browser. The Terminal shows each request, cookie and session change.

Lessons in this section

  1. Endpoints and Server Data

    What endpoints are, .js and .ts endpoint files, HTTP method functions, reading JSON and form data, returning JSON and status codes, static and on-demand endpoints, the APIRoute type, RSS feeds, databases in server code, and advanced routing with src/fetch.ts.

    • Write a GET endpoint that returns JSON
    • Handle POST requests with JSON and form data
    • Choose between static and on-demand endpoints
    • Build an RSS feed from your posts
  2. Middleware and Cookies

    What middleware is, src/middleware.ts, defineMiddleware(), next() and changing responses, sequence(), redirects and rewrites in middleware, sharing data with locals, App.Locals, and reading, setting and deleting cookies with their options.

    • Run code before every request with middleware
    • Share data with pages through locals
    • Read, set and delete cookies safely
    • Choose the right cookie options
  3. Sessions

    What sessions are, sessions vs cookies, session drivers and the adapter defaults, session.get() and set(), what you can store, regenerate() and destroy(), Astro.session and context.session, disabling sessions and typing App.SessionData.

    • Explain how a session differs from a cookie
    • Store and read data with Astro.session
    • Rotate and end sessions safely
    • Pick a session driver for your host
  4. Actions and Forms

    What actions are, defineAction() and the server export, groups, Zod input validation, accept form, isInputError(), calling actions from scripts and HTML forms, getActionResult(), callAction(), ActionError, redirects and securing actions.

    • Define a type-safe action with Zod input
    • Call an action from a script and from a form
    • Show validation errors next to form fields
    • Check the user inside an action
  5. Authentication

    Authentication vs authorization, how login works, session-based login and logout actions, hashing passwords, protecting pages and endpoints in middleware, why path matching is unsafe, roles and ownership, 401 vs 403, and auth libraries.

    • Tell authentication from authorization
    • Build login and logout with sessions and actions
    • Protect pages and endpoints in middleware
    • Check roles and ownership, and answer 401 or 403