Permission middleware in Express - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a middleware function that checks if the user has the required permission.

Express

function checkPermission(permission) {
  return function(req, res, next) {
    if (req.user && req.user.permissions && req.user.permissions.includes([1])) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

Drag options to blanks, or click blank then click option'

Apermissions

Breq.permission

Cpermission

Dreq.user.permission

Attempts:

3 left

💡 Hint

Common Mistakes

Using req.permission instead of the parameter

Checking req.user.permission which is not an array

Using a wrong variable name

The middleware checks if the user's permissions include the given permission argument. So, we use the permission parameter directly.

2fill in blank

medium

Complete the code to apply the permission middleware to an Express route that requires 'admin' permission.

Express

app.get('/admin', [1]('admin'), (req, res) => {
  res.send('Welcome Admin');
});

Drag options to blanks, or click blank then click option'

AcheckPermission

BauthMiddleware

CrequirePermission

DpermissionCheck

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong middleware function name

Not calling the middleware as a function with the permission argument

The middleware function is named checkPermission, so we use it to protect the route.

3fill in blank

hard

Fix the error in the middleware to properly handle missing user or permissions.

Express

function checkPermission(permission) {
  return function(req, res, next) {
    if ([1]) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

Drag options to blanks, or click blank then click option'

Areq.user && req.user.permissions && permission

Breq.user.permissions

Cpermission

Dreq.user?.permissions?.includes(permission)

Attempts:

3 left

💡 Hint

Common Mistakes

Not checking if req.user exists causing errors

Trying to access permissions without safety checks

Using optional chaining req.user?.permissions?.includes(permission) safely checks if user and permissions exist before calling includes.

4fill in blank

hard

Fill both blanks to create a middleware that logs the permission checked and calls next if allowed.

Express

function checkPermission(permission) {
  return function(req, res, next) {
    console.log('Checking permission:', [1]);
    if (req.user?.permissions?.includes([2])) {
      next();
    } else {
      res.status(403).send('Forbidden');
    }
  };
}

Drag options to blanks, or click blank then click option'

Apermission

Breq.user

Creq.user.permissions

Dreq.permission

Attempts:

3 left

💡 Hint

Common Mistakes

Logging req.user instead of permission

Checking wrong variable for permission

We log the permission parameter and check if the user's permissions include that same permission.

5fill in blank

hard

Fill all three blanks to create a permission middleware that sends a JSON error message when forbidden.

Express

function checkPermission([1]) {
  return function(req, res, next) {
    if (req.user?.permissions?.includes([2])) {
      next();
    } else {
      res.status(403).json({ error: [3] });
    }
  };
}

Drag options to blanks, or click blank then click option'

Apermission

C'Access denied'

D'Forbidden'

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names for parameter and check

Sending plain text instead of JSON error

Using incorrect error message string

The function parameter and the check use permission. The JSON error message uses the string 'Forbidden' to clearly indicate the access issue.