Hey, I wanted to ask if it's possible to have two secured deployments (standard vercel protection) to talk to each other? I've add the trusted sources, but it still needs the OIDC token, which is fine, but the problem is it can only get it on server side, so I'd have to add extra roundtrip for my next.js client to call some prepared api route and only then call the real backend or am I missing something and it can be done much more simple?
If you mean you want the browser/client side of one Next.js app to talk to the backend of different Next.js app, then the second app needs to accept traffic from the public and you shouldn't rely on deployment protection. When app A hands an OIDC token to its browser, the user of that browser will be able to extract this token and use it to bypass your deployment protection for all Trusted Sources.
The more secure approach is to make sure only your backends talk to each other. App A can authenticate with its own backend, which can getVercelOidcToken() and privately talk to the other one without ever exposing that token to the browser. This might seem inefficient, but the request time between the backends is usually inconsequential as they're likely just different machines in the same datacenter.
In general, if your frontends only ever make network requests to their own same-origin backends you can avoid huge categories of potential security risks. It allows you to make your auth cookies HttpOnly and SameSite, for example.
what about monorepo? Can it be setup with vercel.json wrerites so backend can be called from frontend under the same domain?
There are two ways to do that
I'd recommend Vercel Services which allows you to deploy two different "apps" to the same Vercel project. Each one can own certain routes. They will always deploy at the same time and therefore always be in sync, which is probably a better fit for your use-case. I've used this to deploy a Next.js frontend with a headless Wordpress backend as a Dockerfile before https://vercel.com/docs/services
Vercel Microfrontends let you deploy separate projects, with independent releases, all under the same domain. This could also work for you but it tends to be useful when you have multiple different teams working on different areas of the same product. We use this for vercel.com to keep different projects for the website and for different parts of the dashboard which are owned by different teams whose permissions we want to keep separate.
