Express JS routing based authentication

Question

I have created node js app using express framework.

I have created middleware for restricting access to some routes.

Middleware actually works fine. but i have difficulties in displaying data.

Suppose In My app i have created route for display list of countries('/country/master')i.e html page which is using internally different/default route ('/country/') to get data from mongoDB.

In this case user will not able to see data cause i have not given permission to "/" routes. but i want to display data but not allow him to make use of "/" route to check data.

How can i deal with this case ????

what do you mean by make use of? if you mean you want to prohibit someone for posting data, you can use middleware for post only. like... app.post('/', yourRestrictionFunction) — Pravin
– Pravin, Commented Jul 13, 2015 at 10:51

robertjd · Accepted Answer · 2015-07-20 18:09:29Z

The answer depends on your authentication strategy i.e. are you using session identifiers, access tokens, etc.

In either case I suggest that you break out the credential exchange (aka login) from the authentication. They should be separate middleware functions. Below is an example of what this looks like.

While this answers your question, specific to ExpressJS, it does leave out a lot of other details that matter when you are building an authentication system (like how to securely store passwords). I work at Stormpath, we provide user management as an API so that you don't have to worry about all the security details! It's very easy to integrate our API into your application, using the express-stormpath module. You'll have a fully featured user database in minutes, without having to setup mongo or a user table.

All that said, here's the example:

/* pseudo example of building your own authentication middleware */

function usernamePasswordExchange(req,res,next){
  var username = req.body.username;
  var password = req.body.password;

  callToAuthService(username,password,function(err,user){
    if(err){
      next(err); // bad password, user doesn’t exist, etc
    }else{
      /*
        this part depends on your application.  do you use
        sessions or access tokens?  you need to send the user
        something that they can use for authentication on
        subsequent requests
      */
      res.end(/* send something */);
    }
  });
}

function authenticate(req,res,next){
  /*
    read the cookie, access token, etc.
    verify that it is legit and then find
    the user that it’s associated with
  */
  validateRequestAndGetUser(req,function(err,user){
    if(err){
      next(err); // session expired, tampered, revoked
    }else{
      req.user = user;
      next();
    }
  });
}

app.post('/login',usernamePasswordExchange);

app.get('/protected-resource',authenticate,function(req,res,next){
  /*
    If we are here we know the user is authenticated and we
    can know who the user is by referencing req.user
  */
});

KlwntSingh · Accepted Answer · 2015-07-13 10:46:28Z

0

You can positioning of middleware in you app.for example:-

app.get('/country/master',function(req,res){

})

app.use(function(req,res){
  your middle ware for providing authentication
})

// other routes where authentication should be enabled
app.get('other urls')

answered Jul 13, 2015 at 10:46

KlwntSingh

1,0928 silver badges27 bronze badges

6 Comments

Overseas634 Over a year ago

i have route "/country/master" which is my html view and "/country/"is default api to get data. which is required for my app to get data and i need when user tries to hit on above url from browser he should be restricted

KlwntSingh Over a year ago

@Overseas634 are u trying to say /country/master is route which gives html page as response.

Overseas634 Over a year ago

yes '/country/master' is route which gives html page as response

KlwntSingh Over a year ago

@Overseas634 than you can try above code.let me know if it does not works.

Overseas634 Over a year ago

I am doing authentication like this" router.get('/master',authentication ,function(req, res, next){}); and it is working fine

|

Collectives™ on Stack Overflow

Express JS routing based authentication

2 Answers 2

Comments

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related