Localized paths + sending the locale to a backend. Where do I have to validate it?

[jonschmidt]

This could be relatively naive set of questions, but lets see.

In the examples, it seems that the locale being passed into the locale segment is only really validated in layout.tsx.

This is what we are doing. We have made an assumption therefore that the locale would be valid in a page.tsx server side component that uses that layout, and since we have some backend translations in our database, we send the locale to our backend so we can pull the right strings.

However, while we were under some kind of probing attack and I noticed that our backend was receiving locales that made no sense, essentially filenames or other random seeming strings. So it turns out that even when /app/[locale]/layout.tsx throws a not found, the logic in our page.tsx was still executing and hitting our backend.

Does this make sense at all? If so, should we then be validating the locale in more than the root layout?

[amannn]

I think this should help to answer your question: #1722 (comment)

[jonschmidt]

Cool. So the suggestion would be then to use

setRequestLocale

and then when I need to use a validated locale

await getLocale()
or
useLocale()

And I would be re-using the validated locale (which could be default in the case where an invalid one was provided)?

[amannn]

Yep, that sounds right! setRequestLocale is really optional here though, the more important part is returning a valid locale in i18n/request.ts.

As mentioned in the other discussion, dynamicParams = false can also be helpful to validate locales early (for apps that support static rendering)—esp. once rootParams becomes a thing.