Protecting routes with auth middleware in Express - Step-by-Step Execution

Concept Flow - Protecting routes with auth middleware

Incoming Request

↓

Auth Middleware

↓

Auth OK

↓

Next Route

↓

Response

The request first passes through auth middleware which checks credentials. If valid, it proceeds to the route handler; if not, it sends a 401 Unauthorized response.

Execution Sample

Express

function auth(req, res, next) {
  if (req.user) next();
  else res.status(401).send('Unauthorized');
}

app.get('/dashboard', auth, (req, res) => {
  res.send('Welcome!');
});

This code checks if a user is logged in before allowing access to the /dashboard route.

Execution Table

Step	Request URL	req.user	Middleware Action	Route Handler Called	Response Sent
1	/dashboard	undefined	Check req.user -> false	No	401 Unauthorized
2	/dashboard	{id:1}	Check req.user -> true	Yes	Welcome!

💡 Execution stops after sending response either from middleware (401) or route handler (Welcome!)

Variable Tracker

Variable	Start	After Step 1	After Step 2
req.user	undefined	undefined	{id:1}
next called	false	false	true
response status	none	401	200
response body	none	'Unauthorized'	'Welcome!'

Key Moments - 2 Insights

Why does the route handler not run when req.user is undefined?

Because the middleware sends a 401 response and does not call next(), stopping further execution as shown in execution_table step 1.

What does calling next() inside middleware do?

Calling next() passes control to the next middleware or route handler, allowing the request to continue as shown in execution_table step 2.

Visual Quiz - 3 Questions

Look at the execution_table, what response is sent when req.user is missing?

A 401 Unauthorized

B Welcome!

C 404 Not Found

D 500 Internal Server Error

💡 Hint

Check execution_table row 1 under 'Response Sent'

At which step does the route handler get called?

A Step 1

B Step 2

C Neither step

D Both steps

💡 Hint

Look at 'Route Handler Called' column in execution_table

If middleware always calls next() without checking req.user, what happens?

A Middleware blocks all requests

B Server crashes

C Unauthorized users access the route

D Response is always 401

💡 Hint

Think about what happens if middleware never sends 401 and always calls next()

Concept Snapshot

Protect routes by adding auth middleware before route handlers.
Middleware checks if user is logged in (req.user).
If yes, call next() to continue.
If no, send 401 Unauthorized response.
This stops unauthorized access simply and clearly.

Full Transcript

In Express, protecting routes means checking if a user is logged in before allowing access. We write a middleware function that looks at req.user. If req.user exists, it calls next() to let the request continue to the route handler. If not, it sends a 401 Unauthorized response and stops. This way, only authorized users reach the route. The execution table shows two cases: one where req.user is missing and the middleware sends 401, and one where req.user exists and the route handler sends a welcome message. Key points are that calling next() passes control forward, and not calling next() stops the request. If middleware always calls next() without checking, unauthorized users can access protected routes. This pattern keeps routes safe with simple checks.

Practice

1. What is the main purpose of auth middleware in an Express app?

easy

A. To check if a user is allowed to access a route

B. To format the response data before sending

C. To log every request made to the server

D. To serve static files like images and CSS

Solution

1. Step 1: Understand middleware role

   Middleware runs before route handlers to process requests.

2. Step 2: Identify auth middleware function

   Auth middleware specifically checks user permissions to allow or deny access.

3. Final Answer:

   To check if a user is allowed to access a route -> Option A

4. Quick Check:

   Auth middleware = Access control [OK]

Hint: Auth middleware controls access to routes [OK]

Common Mistakes:

• Confusing auth middleware with logging middleware
• Thinking middleware serves static files
• Assuming middleware formats response data

2. Which of the following is the correct way to use auth middleware for a route in Express?

easy

A. app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); });

B. app.get(authMiddleware, '/profile', (req, res) => { res.send('Profile'); });

C. app.get('/profile', (req, res) => { authMiddleware(); res.send('Profile'); });

D. app.get('/profile', (req, res) => { res.send('Profile'); }, authMiddleware);

Solution

1. Step 1: Recall Express route syntax

   Middleware functions come before the final route handler in the argument list.

2. Step 2: Check each option's order

   Only app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); }); places authMiddleware correctly before the handler function.

3. Final Answer:

   app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); }); -> Option A

4. Quick Check:

   Middleware before handler = app.get('/profile', authMiddleware, (req, res) => { res.send('Profile'); }); [OK]

Hint: Middleware goes before the route handler function [OK]

Common Mistakes:

• Placing middleware after the handler
• Passing middleware as the first argument instead of path
• Calling middleware inside the handler instead of passing it

3. Given this auth middleware, what will happen when a request without a valid token hits the protected route?

function authMiddleware(req, res, next) {
  if (req.headers.authorization === 'valid-token') {
    next();
  } else {
    res.status(401).send('Unauthorized');
  }
}

app.get('/dashboard', authMiddleware, (req, res) => {
  res.send('Welcome to dashboard');
});

medium

A. The user sees 'Welcome to dashboard' regardless of token

B. The server crashes due to missing next() call

C. The user gets a 401 Unauthorized response if token is missing or invalid

D. The user gets a 404 Not Found error

Solution

1. Step 1: Analyze authMiddleware logic

   If the authorization header equals 'valid-token', next() is called to continue.

2. Step 2: Check behavior when token is missing or invalid

   Else block sends 401 Unauthorized response and does not call next(), blocking access.

3. Final Answer:

   The user gets a 401 Unauthorized response if token is missing or invalid -> Option C

4. Quick Check:

   Invalid token = 401 Unauthorized [OK]

Hint: Middleware sends 401 if token invalid, else calls next() [OK]

Common Mistakes:

• Assuming next() is always called
• Thinking user always sees dashboard
• Confusing 401 with 404 errors

4. Identify the error in this auth middleware code:

function authMiddleware(req, res, next) {
  if (!req.user) {
    res.status(403).send('Forbidden');
  }
  next();
}

medium

A. Missing call to next() inside the if block

B. next() is called even after sending a response, causing an error

C. Status code 403 is incorrect for unauthorized access

D. req.user should be checked with req.auth instead

Solution

1. Step 1: Understand middleware flow

   If !req.user is true, response is sent with status 403.

2. Step 2: Check what happens after sending response

   next() is called unconditionally after the if block, so it runs even after response sent, causing errors.

3. Final Answer:

   next() is called even after sending a response, causing an error -> Option B

4. Quick Check:

   Call next() only if no response sent [OK]

Hint: Do not call next() after sending a response [OK]

Common Mistakes:

• Calling next() after res.send()
• Not stopping middleware after response
• Using wrong status codes for auth errors

5. You want to protect multiple routes with the same auth middleware and also log the user ID if authenticated. Which is the best way to do this?

function authMiddleware(req, res, next) {
  if (!req.headers.authorization) {
    return res.status(401).send('Unauthorized');
  }
  req.userId = req.headers.authorization;
  next();
}

// How to apply this middleware and log userId for routes '/profile' and '/settings'?

hard

A. Apply authMiddleware after route handlers to log userId

B. Add authMiddleware only to '/profile' route and log userId in '/settings' without middleware

C. Call authMiddleware inside each route handler manually before logging userId

D. Use app.use(authMiddleware) before defining both routes, then log req.userId inside each route handler

Solution

1. Step 1: Understand middleware application

   app.use(authMiddleware) applies middleware to all routes defined after it, protecting multiple routes easily.

2. Step 2: Logging userId in route handlers

   Since authMiddleware sets req.userId, route handlers can access and log it safely after middleware runs.

3. Final Answer:

   Use app.use(authMiddleware) before defining both routes, then log req.userId inside each route handler -> Option D

4. Quick Check:

   Use app.use for shared middleware [OK]

Hint: Use app.use(authMiddleware) to protect many routes [OK]

Common Mistakes:

• Applying middleware only to some routes inconsistently
• Calling middleware inside handlers manually
• Applying middleware after route handlers