Recommend router-based route protection over pathname-string auth checks

[matthewp]

Description (required)

In the path we have documenting using patterns like context.url.pathname.startsWith('/dashboard') to only apply auth requirements to certain routes. This had led to numerous security issues such as double-encoded URLs, base-stripped URLs not matching the string check, etc. It was a mistake for Astro to make Astro.url by anything other than the raw request URL. We have attempted to "normalize" this value for users to match what they expect. If the user is going to the dashboard.astro route they expect the URL to also be /dashboard. But this means that Astro has taken on the burden of the pathname not actually matching user expectations.

I hope to make a breaking change to how Astro.url works in 8.0 so that we no longer normalize the value for the user at all. In the mean time I want to immediately move away from documenting a bad practice. Instead if you want to apply middleware to certain routes, use a router like Hono.

This updates the docs both to show the preferred method, as well as to discourage the old.

References

Not related to any pull-requests or Astro issues.

[astrobot-houston]

Lunaria Status Overview

🌕 This pull request will trigger status changes.

Learn more

By default, every PR changing files present in the Lunaria configuration's files property will be considered and trigger status changes accordingly.

You can change this by adding one of the keywords present in the ignoreKeywords property in your Lunaria configuration file in the PR's title (ignoring all files) or by including a tracker directive in the merged commit's description.

Tracked Files

File	Note
en/guides/authentication.mdx	Source changed, localizations will be marked as outdated.
en/guides/routing.mdx	Source changed, localizations will be marked as outdated.

Warnings reference

Icon	Description
🔄️	The source for this localization has been updated since the creation of this pull request, make sure all changes in the source have been applied.

[github-actions]

Preview deployment

✅ Deployment complete!

• Latest commit: 92c969a
• Preview: https://docs-auth-pathname-guidance.previews.docs.astro.build
• Workflow run: View logs

[ArmandPhilippot]

I left two suggestions regarding the caution, which may be a bit long for a single paragraph (especially the first one).

Otherwise, LGTM! And, you plan for v8 makes sense to me! 👍🏽