Admin vs user route protection in Express - Quick Revision & Key Differences

Recall & Review

beginner

What is route protection in Express?

Route protection means controlling access to certain routes based on user roles or authentication status to keep parts of the app secure.

beginner

How do you check if a user is an admin in Express middleware?

You check the user's role stored in the request (like req.user.role) and allow access only if it equals 'admin'.

beginner

Why separate admin routes from user routes?

Separating routes helps keep admin functions secure and prevents regular users from accessing sensitive actions.

beginner

What happens if a user tries to access an admin route without permission?

The middleware blocks access and usually sends a 403 Forbidden response or redirects the user.

intermediate

How can you reuse route protection logic in Express?

By creating middleware functions that check roles and applying them to routes that need protection.

What Express feature is commonly used to protect routes based on user roles?

A Query parameters

B Static files

C Middleware functions

D Template engines

Middleware functions run before route handlers and can check user roles to allow or deny access.

If a user is not an admin, what HTTP status code should you send when blocking access?

A 500 Internal Server Error

B 200 OK

C 404 Not Found

D 403 Forbidden

403 Forbidden means the server understood the request but refuses to authorize it.

Where is user role information typically stored for route protection?

A In req.user or session

B In req.body

C In URL parameters

D In cookies only

User info like roles is usually attached to req.user after authentication or stored in session.

What is a good practice to avoid repeating role checks in many routes?

A Write role checks inside every route handler

B Use middleware functions for role checks

C Ignore role checks

D Use client-side JavaScript for protection

Middleware lets you write role checks once and apply them to many routes easily.

Which of these is NOT a reason to protect admin routes separately?

A Make admin routes slower

B Improve app security

C Prevent unauthorized access

D Keep sensitive actions safe

Protecting routes does not intentionally slow them down; it secures access.

Explain how you would protect an admin route in Express using middleware.

Think about checking user role before allowing access.

Why is it important to separate admin and user routes in a web app?

Consider what could happen if users access admin features.