Middleware composition for auth layers in Express - Mini Project: Build & Apply

Middleware Composition for Auth Layers in Express

📖 Scenario: You are building a simple Express server that needs to protect certain routes with authentication and authorization checks. Middleware functions will help you organize these checks step-by-step.

🎯 Goal: Build an Express app that uses composed middleware functions to check if a user is logged in and if they have admin rights before accessing a protected route.

📋 What You'll Learn

Create a middleware function called checkLoggedIn that verifies if req.user exists.

Create a middleware function called checkAdmin that verifies if req.user.role is 'admin'.

Compose these middleware functions in the correct order for a protected route /admin.

Send a success response 'Welcome Admin' if all checks pass.

💡 Why This Matters

🌍 Real World

Middleware composition is a common pattern in web servers to separate concerns like authentication, authorization, logging, and error handling. This makes code easier to read and maintain.

💼 Career

Understanding middleware in Express is essential for backend web development jobs, especially when building secure APIs and web applications.

1

Setup Express app and user data

Create an Express app by requiring express and calling express(). Then create a middleware function called mockUser that adds a user object { name: 'Alice', role: 'admin' } to req.user. Use app.use(mockUser) to apply it globally.

Express

const express = require('express');
const app = express();

// Your code here

Hint

Start by importing Express and creating the app. Then write a middleware that sets req.user to the given object and call next().

2

Create authentication middleware

Create a middleware function called checkLoggedIn that checks if req.user exists. If it does, call next(). Otherwise, send a 401 status with message 'Not logged in'. Add this function below the mockUser middleware.

Express

const express = require('express');
const app = express();

function mockUser(req, res, next) {
    req.user = { name: 'Alice', role: 'admin' };
    next();
}

app.use(mockUser);

// Your code here

Hint

Check if req.user exists. If yes, call next(). Otherwise, respond with 401 and a message.

3

Create authorization middleware

Create a middleware function called checkAdmin that checks if req.user.role is exactly 'admin'. If yes, call next(). Otherwise, send a 403 status with message 'Access denied'. Add this function below checkLoggedIn.

Express

const express = require('express');
const app = express();

function mockUser(req, res, next) {
    req.user = { name: 'Alice', role: 'admin' };
    next();
}

app.use(mockUser);

function checkLoggedIn(req, res, next) {
    if (req.user) {
        next();
    } else {
        res.status(401).send('Not logged in');
    }
}

// Your code here

Hint

Check if req.user.role equals 'admin'. If yes, call next(). Otherwise, respond with 403 and a message.

4

Compose middleware for protected route

Create a GET route /admin that uses the middleware functions checkLoggedIn and checkAdmin in that order. The route handler should send the text 'Welcome Admin'. Use app.listen(3000) to start the server.

Express

const express = require('express');
const app = express();

function mockUser(req, res, next) {
    req.user = { name: 'Alice', role: 'admin' };
    next();
}

app.use(mockUser);

function checkLoggedIn(req, res, next) {
    if (req.user) {
        next();
    } else {
        res.status(401).send('Not logged in');
    }
}

function checkAdmin(req, res, next) {
    if (req.user.role === 'admin') {
        next();
    } else {
        res.status(403).send('Access denied');
    }
}

// Your code here

Hint

Use app.get with the path '/admin' and pass checkLoggedIn and checkAdmin as middleware before the final handler. Then start the server on port 3000.

Practice

1. What is the main purpose of composing multiple middleware functions for authentication in Express?

easy

A. To run several small auth checks in order before allowing access

B. To combine all auth logic into one big function

C. To skip authentication for faster response

D. To handle database queries inside middleware

Solution

1. Step 1: Understand middleware composition

   Middleware composition means running multiple middleware functions one after another.

2. Step 2: Purpose in auth layers

   Using multiple small auth checks in order helps keep code clean and checks each condition separately.

3. Final Answer:

   To run several small auth checks in order before allowing access -> Option A

4. Quick Check:

   Middleware composition = multiple small auth checks [OK]

Hint: Think of middleware as a chain of small checks [OK]

Common Mistakes:

• Thinking all auth logic must be in one function
• Believing middleware skips auth
• Confusing middleware with database queries

2. Which of the following is the correct way to apply two middleware functions checkToken and checkRole to an Express route using an array?

easy

A. app.get('/admin', checkToken, checkRole, (req, res) => res.send('OK'))

B. app.get('/admin', checkToken && checkRole, (req, res) => res.send('OK'))

C. app.get('/admin', [checkToken, checkRole], (req, res) => res.send('OK'))

D. app.get('/admin', checkToken || checkRole, (req, res) => res.send('OK'))

Solution

1. Step 1: Understand Express middleware syntax

   Express accepts multiple middleware as an array or separate arguments before the handler. This question specifies using an array.

2. Step 2: Check each option

   A uses separate arguments. B and D use logical operators which are invalid here. C correctly uses an array.

3. Final Answer:

   app.get('/admin', [checkToken, checkRole], (req, res) => res.send('OK')) -> Option C

4. Quick Check:

   Middleware array syntax = app.get('/admin', [checkToken, checkRole], (req, res) => res.send('OK')) [OK]

Hint: Use arrays to group middleware in routes [OK]

Common Mistakes:

• Using logical operators instead of arrays
• Passing middleware as a single combined expression
• Forgetting to include middleware before handler

3. Given the middleware functions below, what will be the response when a request with req.user = { role: 'user' } hits the route?

function checkToken(req, res, next) {
  if (!req.user) return res.status(401).send('No token');
  next();
}

function checkAdmin(req, res, next) {
  if (req.user.role !== 'admin') return res.status(403).send('Forbidden');
  next();
}

app.get('/secure', [checkToken, checkAdmin], (req, res) => res.send('Welcome admin'));

medium

A. Welcome admin

B. Forbidden

C. No token

D. Internal Server Error

Solution

1. Step 1: Analyze checkToken middleware

   It checks if req.user exists. Here req.user is { role: 'user' }, so it passes and calls next().

2. Step 2: Analyze checkAdmin middleware

   It checks if req.user.role is 'admin'. Here it is 'user', so it returns 403 Forbidden response.

3. Final Answer:

   Forbidden -> Option B

4. Quick Check:

   Role check fails = Forbidden [OK]

Hint: Check middleware order and conditions carefully [OK]

Common Mistakes:

• Assuming role 'user' passes admin check
• Ignoring middleware that sends response early
• Confusing status codes

4. Identify the error in this middleware composition code:

function auth(req, res, next) {
  if (!req.headers.authorization) {
    res.status(401).send('Unauthorized');
  }
  next();
}

app.get('/data', auth, (req, res) => res.send('Data'));

medium

A. Missing return after sending 401 response, so next() runs anyway

B. Middleware should be async function

C. Route handler missing res.end() call

D. Authorization header check should be in route handler

Solution

1. Step 1: Check middleware flow

   If authorization header is missing, it sends 401 but does not stop execution.

2. Step 2: Identify missing return

   Without return after res.status(401).send(), next() is called anyway, causing route handler to run incorrectly.

3. Final Answer:

   Missing return after sending 401 response, so next() runs anyway -> Option A

4. Quick Check:

   Send response must stop middleware with return [OK]

Hint: Always return after sending response in middleware [OK]

Common Mistakes:

• Calling next() after sending response
• Thinking async needed for simple middleware
• Putting auth logic in route handler

5. You want to create a reusable middleware group for routes that require both token validation and admin role check. Which is the best way to compose and apply these middlewares in Express?

hard

A. Use a global app.use() for all routes regardless of auth needs

B. Create a single middleware combining both checks and use it in routes

C. Call each middleware manually inside the route handler function

D. Use an array of separate middlewares and apply the array to routes

Solution

1. Step 1: Understand middleware grouping

   Grouping middlewares as an array keeps each check separate and reusable.

2. Step 2: Compare options

   Use an array of separate middlewares and apply the array to routes uses an array of middlewares applied to routes, which is clean and composable. Create a single middleware combining both checks and use it in routes merges checks into one, losing modularity. Call each middleware manually inside the route handler function is manual and error-prone. Use a global app.use() for all routes regardless of auth needs applies auth globally, which is not selective.

3. Final Answer:

   Use an array of separate middlewares and apply the array to routes -> Option D

4. Quick Check:

   Middleware arrays = reusable and clean [OK]

Hint: Group middlewares in arrays for reuse [OK]

Common Mistakes:

• Combining all logic into one middleware
• Calling middleware inside handlers manually
• Applying auth globally without route control