Protecting routes with auth middleware in Express - Mini Project: Build & Apply

Protecting routes with auth middleware

📖 Scenario: You are building a simple web server using Express.js. Some routes should only be accessible to users who are logged in. To do this, you will create a middleware function that checks if a user is authenticated before allowing access to those routes.

🎯 Goal: Build an Express.js server with a middleware function called authMiddleware that protects a route /dashboard. Only requests with a valid req.user property can access the dashboard. Others get a 401 Unauthorized response.

📋 What You'll Learn

Create an Express app variable called app

Create a middleware function called authMiddleware

Use authMiddleware to protect the /dashboard route

Send a 401 status with message 'Unauthorized' if user is not authenticated

Send a 200 status with message 'Welcome to your dashboard' if authenticated

💡 Why This Matters

🌍 Real World

Web applications often need to restrict access to certain pages or APIs to logged-in users only. Middleware is a common way to check authentication before allowing access.

💼 Career

Understanding how to protect routes with middleware is essential for backend developers working with Express.js or similar web frameworks.

1

Set up Express app and a sample user

Create an Express app by requiring express and calling express(). Also create a sample user object called user with id 1 and name 'Alice'.

Express

const express = require('express');
// Your code here

Hint

Use const app = express() to create the app. Define user as an object with id and name.

2

Create auth middleware function

Create a middleware function called authMiddleware that takes req, res, and next. Inside, set req.user to the user object you created. Then call next().

Express

const express = require('express');
const app = express();

const user = { id: 1, name: 'Alice' };

// Your code here

Hint

Define authMiddleware as a function with three parameters. Assign req.user = user and call next() to continue.

3

Protect the /dashboard route with authMiddleware

Create a GET route /dashboard on app. Use authMiddleware as the middleware for this route. Inside the route handler, check if req.user exists. If it does, send status 200 with JSON message 'Welcome to your dashboard'. If not, send status 401 with JSON message 'Unauthorized'.

Express

const express = require('express');
const app = express();

const user = { id: 1, name: 'Alice' };

function authMiddleware(req, res, next) {
    req.user = user;
    next();
}

// Your code here

Hint

Use app.get with /dashboard and authMiddleware. Check req.user inside the handler and respond accordingly.

4

Start the Express server

Add code to start the Express server by calling app.listen on port 3000. Inside the callback, log the message 'Server running on port 3000'.

Express

const express = require('express');
const app = express();

const user = { id: 1, name: 'Alice' };

function authMiddleware(req, res, next) {
    req.user = user;
    next();
}

app.get('/dashboard', authMiddleware, (req, res) => {
    if (req.user) {
        res.status(200).json({ message: 'Welcome to your dashboard' });
    } else {
        res.status(401).json({ message: 'Unauthorized' });
    }
});

// Your code here

Hint

Use app.listen with port 3000 and a callback that logs the message.

Practice

1. What is the main purpose of auth middleware in an Express app?

easy

A. To check if a user is allowed to access a route

B. To format the response data before sending

C. To log every request made to the server

D. To serve static files like images and CSS

Solution

1. Step 1: Understand middleware role

   Middleware runs before route handlers to process requests.

2. Step 2: Identify auth middleware function

   Auth middleware specifically checks user permissions to allow or deny access.

3. Final Answer:

   To check if a user is allowed to access a route -> Option A

4. Quick Check:

   Auth middleware = Access control [OK]

Hint: Auth middleware controls access to routes [OK]

Common Mistakes:

• Confusing auth middleware with logging middleware
• Thinking middleware serves static files
• Assuming middleware formats response data

2. Which of the following is the correct way to use auth middleware for a route in Express?

easy

A. app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); });

B. app.get(authMiddleware, '/profile', (req, res) => { res.send('Profile'); });

C. app.get('/profile', (req, res) => { authMiddleware(); res.send('Profile'); });

D. app.get('/profile', (req, res) => { res.send('Profile'); }, authMiddleware);

Solution

1. Step 1: Recall Express route syntax

   Middleware functions come before the final route handler in the argument list.

2. Step 2: Check each option's order

   Only app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); }); places authMiddleware correctly before the handler function.

3. Final Answer:

   app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); }); -> Option A

4. Quick Check:

   Middleware before handler = app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); }); [OK]

Hint: Middleware goes before the route handler function [OK]

Common Mistakes:

• Placing middleware after the handler
• Passing middleware as the first argument instead of path
• Calling middleware inside the handler instead of passing it

3. Given this auth middleware, what will happen when a request without a valid token hits the protected route?

function authMiddleware(req, res, next) {
  if (req.headers.authorization === 'valid-token') {
    next();
  } else {
    res.status(401).send('Unauthorized');
  }
}

app.get('/dashboard', authMiddleware, (req, res) => {
  res.send('Welcome to dashboard');
});

medium

A. The user sees 'Welcome to dashboard' regardless of token

B. The server crashes due to missing next() call

C. The user gets a 401 Unauthorized response if token is missing or invalid

D. The user gets a 404 Not Found error

Solution

1. Step 1: Analyze authMiddleware logic

   If the authorization header equals 'valid-token', next() is called to continue.

2. Step 2: Check behavior when token is missing or invalid

   Else block sends 401 Unauthorized response and does not call next(), blocking access.

3. Final Answer:

   The user gets a 401 Unauthorized response if token is missing or invalid -> Option C

4. Quick Check:

   Invalid token = 401 Unauthorized [OK]

Hint: Middleware sends 401 if token invalid, else calls next() [OK]

Common Mistakes:

• Assuming next() is always called
• Thinking user always sees dashboard
• Confusing 401 with 404 errors

4. Identify the error in this auth middleware code:

function authMiddleware(req, res, next) {
  if (!req.user) {
    res.status(403).send('Forbidden');
  }
  next();
}

medium

A. Missing call to next() inside the if block

B. next() is called even after sending a response, causing an error

C. Status code 403 is incorrect for unauthorized access

D. req.user should be checked with req.auth instead

Solution

1. Step 1: Understand middleware flow

   If !req.user is true, response is sent with status 403.

2. Step 2: Check what happens after sending response

   next() is called unconditionally after the if block, so it runs even after response sent, causing errors.

3. Final Answer:

   next() is called even after sending a response, causing an error -> Option B

4. Quick Check:

   Call next() only if no response sent [OK]

Hint: Do not call next() after sending a response [OK]

Common Mistakes:

• Calling next() after res.send()
• Not stopping middleware after response
• Using wrong status codes for auth errors

5. You want to protect multiple routes with the same auth middleware and also log the user ID if authenticated. Which is the best way to do this?

function authMiddleware(req, res, next) {
  if (!req.headers.authorization) {
    return res.status(401).send('Unauthorized');
  }
  req.userId = req.headers.authorization;
  next();
}

// How to apply this middleware and log userId for routes '/profile' and '/settings'?

hard

A. Apply authMiddleware after route handlers to log userId

B. Add authMiddleware only to '/profile' route and log userId in '/settings' without middleware

C. Call authMiddleware inside each route handler manually before logging userId

D. Use app.use(authMiddleware) before defining both routes, then log req.userId inside each route handler

Solution

1. Step 1: Understand middleware application

   app.use(authMiddleware) applies middleware to all routes defined after it, protecting multiple routes easily.

2. Step 2: Logging userId in route handlers

   Since authMiddleware sets req.userId, route handlers can access and log it safely after middleware runs.

3. Final Answer:

   Use app.use(authMiddleware) before defining both routes, then log req.userId inside each route handler -> Option D

4. Quick Check:

   Use app.use for shared middleware [OK]

Hint: Use app.use(authMiddleware) to protect many routes [OK]

Common Mistakes:

• Applying middleware only to some routes inconsistently
• Calling middleware inside handlers manually
• Applying middleware after route handlers