Resource ownership checks in Express - Mini Project: Build & Apply

Resource Ownership Checks in Express

📖 Scenario: You are building a simple Express server for a blog. Each blog post belongs to a user. You want to make sure that only the owner of a post can edit or delete it.

🎯 Goal: Create an Express route that checks if the logged-in user owns the blog post before allowing updates or deletions.

📋 What You'll Learn

Create a sample posts data array with exact entries

Add a variable for the current logged-in user ID

Write a middleware function to check ownership of a post by ID

Use the middleware in a route to protect post editing

💡 Why This Matters

🌍 Real World

Web apps often need to make sure users can only change their own data, like posts or profiles.

💼 Career

Understanding resource ownership checks is key for backend developers to build secure APIs.

1

Create sample posts data

Create a variable called posts that is an array with these exact objects: { id: 1, title: 'First Post', ownerId: 101 }, { id: 2, title: 'Second Post', ownerId: 102 }, and { id: 3, title: 'Third Post', ownerId: 101 }.

Express

# Your code here

Hint

Use const posts = [ ... ] with the exact objects inside.

2

Set current logged-in user ID

Create a variable called currentUserId and set it to 101 to represent the logged-in user.

Express

const posts = [
  { id: 1, title: 'First Post', ownerId: 101 },
  { id: 2, title: 'Second Post', ownerId: 102 },
  { id: 3, title: 'Third Post', ownerId: 101 }
];

# Your code here

Hint

Use const currentUserId = 101; exactly.

3

Create ownership check middleware

Write a middleware function called checkOwnership that takes req, res, next. It should get the post ID from req.params.id, find the post in posts, and if the post's ownerId is not equal to currentUserId, respond with status 403 and message 'Forbidden'. Otherwise, call next().

Express

const posts = [
  { id: 1, title: 'First Post', ownerId: 101 },
  { id: 2, title: 'Second Post', ownerId: 102 },
  { id: 3, title: 'Third Post', ownerId: 101 }
];

const currentUserId = 101;

# Your code here

Hint

Use req.params.id to get the post ID and check ownership. Call next() if allowed.

4

Use middleware in update route

Create an Express route handler for PUT /posts/:id that uses the checkOwnership middleware. The route should send a response with the text 'Post updated' if ownership check passes.

Express

const posts = [
  { id: 1, title: 'First Post', ownerId: 101 },
  { id: 2, title: 'Second Post', ownerId: 102 },
  { id: 3, title: 'Third Post', ownerId: 101 }
];

const currentUserId = 101;

function checkOwnership(req, res, next) {
  const postId = Number(req.params.id);
  const post = posts.find(p => p.id === postId);
  if (!post || post.ownerId !== currentUserId) {
    return res.status(403).send('Forbidden');
  }
  next();
}

const express = require('express');
const app = express();

# Your code here

Hint

Use app.put('/posts/:id', checkOwnership, (req, res) => { ... }) to protect the route.

Practice

1. What is the main purpose of resource ownership checks in an Express app?

easy

A. To allow any user to edit any resource

B. To ensure only the owner can access or modify their resource

C. To speed up database queries

D. To log user activity for analytics

Solution

1. Step 1: Understand resource ownership

   Resource ownership means a resource belongs to a specific user.

2. Step 2: Purpose of ownership checks

   Ownership checks prevent unauthorized users from accessing or changing resources they don't own.

3. Final Answer:

   To ensure only the owner can access or modify their resource -> Option B

4. Quick Check:

   Ownership check = restrict access to owner [OK]

Hint: Ownership checks block non-owners from resource access [OK]

Common Mistakes:

• Thinking ownership checks speed up queries
• Allowing all users to edit resources
• Confusing ownership with logging

2. Which Express middleware pattern correctly checks if the logged-in user owns a resource with ID in req.params.id and owner ID in resource.ownerId?

easy

A. if (req.user.id == resource.owner) { next(); } else { res.status(401).send('Unauthorized'); }

B. if (req.user === resource.ownerId) { next(); } else { res.status(404).send('Not Found'); }

C. if (req.user.id === resource.ownerId) { next(); } else { res.status(403).send('Forbidden'); }

D. if (req.user.id !== resource.ownerId) { next(); } else { res.status(403).send('Forbidden'); }

Solution

1. Step 1: Check user ID equality

   We compare req.user.id with resource.ownerId using strict equality to confirm ownership.

2. Step 2: Respond with 403 if not owner

   If IDs don't match, respond with 403 Forbidden to block access.

3. Final Answer:

   if (req.user.id === resource.ownerId) { next(); } else { res.status(403).send('Forbidden'); } -> Option C

4. Quick Check:

   Strict equality + 403 Forbidden = correct ownership check [OK]

Hint: Use strict equality and 403 status for ownership checks [OK]

Common Mistakes:

• Using == instead of ===
• Sending wrong status codes like 404 or 401
• Comparing whole user object instead of user ID

3. Given this Express route snippet, what will happen if req.user.id is '123' and resource.ownerId is '456'?

app.delete('/items/:id', (req, res) => {
  const resource = {ownerId: '456'};
  if (req.user.id === resource.ownerId) {
    res.send('Deleted');
  } else {
    res.status(403).send('Forbidden');
  }
});

medium

A. The item will be deleted and 'Deleted' sent

B. The server will crash due to undefined resource

C. Response will be 404 Not Found

D. Response will be 403 Forbidden

Solution

1. Step 1: Compare user ID and owner ID

   Since req.user.id ('123') does not equal resource.ownerId ('456'), ownership check fails.

2. Step 2: Return 403 Forbidden

   The else block sends a 403 Forbidden response blocking deletion.

3. Final Answer:

   Response will be 403 Forbidden -> Option D

4. Quick Check:

   Non-matching IDs = 403 Forbidden [OK]

Hint: Non-owner gets 403 Forbidden response [OK]

Common Mistakes:

• Assuming deletion happens anyway
• Confusing 403 with 404
• Ignoring ownership check logic

4. Identify the bug in this ownership check middleware:

function checkOwnership(req, res, next) {
  const resource = {ownerId: '456'}; /* example */
  if (req.user.id = resource.ownerId) {
    next();
  } else {
    res.status(403).send('Forbidden');
  }
}

medium

A. Using assignment (=) instead of comparison (===) in the if condition

B. Missing call to next() in else block

C. Incorrect status code; should be 404 instead of 403

D. resource.ownerId is undefined

Solution

1. Step 1: Check the if condition syntax

   The condition uses single equals (=), which assigns instead of compares, causing a bug.

2. Step 2: Correct comparison operator

   It should use strict equality (===) to compare req.user.id and resource.ownerId.

3. Final Answer:

   Using assignment (=) instead of comparison (===) in the if condition -> Option A

4. Quick Check:

   Assignment in if condition = bug [OK]

Hint: Use === for comparison, not = assignment [OK]

Common Mistakes:

• Confusing = with === in conditions
• Thinking next() needed in else block
• Wrong status code for forbidden access

5. You want to protect a route so only the owner of a blog post can edit it. The post's owner ID is stored in post.ownerId. Which Express middleware correctly implements this ownership check and returns 403 if the user is not the owner?

hard

A. app.put('/posts/:id', (req, res, next) => { if (req.user.id === post.ownerId) next(); else res.status(403).send('Forbidden'); }, (req, res) => { res.send('Post updated'); });

B. app.put('/posts/:id', (req, res) => { if (req.user.id !== post.ownerId) res.status(403).send('Forbidden'); else res.send('Post updated'); });

C. app.put('/posts/:id', (req, res, next) => { if (req.user.id == post.ownerId) next(); else res.status(404).send('Not Found'); }, (req, res) => { res.send('Post updated'); });

D. app.put('/posts/:id', (req, res) => { if (req.user.id === post.ownerId) res.send('Post updated'); else res.status(401).send('Unauthorized'); });

Solution

1. Step 1: Use middleware to check ownership before update

   Middleware checks if req.user.id matches post.ownerId and calls next() if true.

2. Step 2: Return 403 Forbidden if not owner

   If IDs don't match, respond with 403 to block unauthorized edits.

3. Final Answer:

   app.put('/posts/:id', (req, res, next) => { if (req.user.id === post.ownerId) next(); else res.status(403).send('Forbidden'); }, (req, res) => { res.send('Post updated'); }); -> Option A

4. Quick Check:

   Middleware + strict equality + 403 Forbidden = correct pattern [OK]

Hint: Use middleware with strict check and 403 response [OK]

Common Mistakes:

• Using == instead of ===
• Sending wrong status codes like 404 or 401
• Not using middleware pattern for ownership check