Permission middleware in Express - Step-by-Step Execution

Concept Flow - Permission middleware

Request received

↓

Permission middleware runs

↓

Check user permissions

↓

Call next

↓

Route handler

When a request comes in, the permission middleware checks if the user has rights. If yes, it passes control to the next handler; if no, it stops and sends a forbidden error.

Execution Sample

Express

function permissionMiddleware(req, res, next) {
  if (req.user?.role === 'admin') {
    next();
  } else {
    res.status(403).send('Forbidden');
  }
}

This middleware checks if the user role is 'admin'. If yes, it allows the request to continue; otherwise, it blocks with a 403 error.

Execution Table

Step	Action	Check	Result	Next Step
1	Middleware called	req.user?.role === 'admin'	true	Call next() to continue
2	Route handler executes	N/A	Request handled	Response sent
3	Middleware called	req.user?.role === 'admin'	false	Send 403 Forbidden response
4	Response ends	N/A	Request blocked	No further handlers called

💡 Execution stops either by calling next() if permission granted or sending 403 if denied.

Variable Tracker

Variable	Start	After Step 1	After Step 3	Final
req.user.role	undefined or 'admin' or other	'admin'	'user'	'admin' or 'user'
next called	false	true	false	true or false
response status	200 by default	200	403	200 or 403

Key Moments - 2 Insights

Why does the middleware call next() only when the user role is 'admin'?

Because the middleware checks if req.user.role equals 'admin' (see execution_table step 1). If true, next() is called to continue processing; otherwise, it sends a 403 response and stops.

What happens if req.user is undefined?

The optional chaining (req.user?.role) safely returns undefined, so the condition fails and the middleware sends a 403 Forbidden response (see execution_table step 3).

Visual Quiz - 3 Questions

Look at the execution_table, what happens at step 3 when the user role is not 'admin'?

A The middleware sends a 403 Forbidden response

B The middleware calls next() to continue

C The route handler executes normally

D The request is redirected

💡 Hint

Check the 'Result' and 'Next Step' columns in execution_table row 3

According to variable_tracker, what is the value of 'next called' after step 1 if the user role is 'admin'?

A false

B undefined

C true

D null

💡 Hint

Look at 'next called' value after Step 1 in variable_tracker

If req.user is undefined, how does the middleware behave according to the execution flow?

A Calls next() and continues

B Sends 403 Forbidden response

C Throws an error

D Skips middleware

💡 Hint

Refer to key_moments explanation about optional chaining and execution_table step 3

Concept Snapshot

Permission middleware in Express:
- Function checks user permissions from req.user
- If permission granted, call next() to continue
- If denied, send 403 Forbidden response
- Use optional chaining to avoid errors if user missing
- Stops request flow on denial, allowing secure routes

Full Transcript

Permission middleware in Express runs when a request arrives. It checks if the user has the right role, for example 'admin'. If yes, it calls next() to let the request continue to the route handler. If no, it sends a 403 Forbidden response and stops further processing. Optional chaining helps avoid errors if the user object is missing. This middleware protects routes by blocking unauthorized users.