Role-based access control in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Role-based Access Control (RBAC)?

RBAC is a way to control who can do what in an app by assigning roles to users. Each role has permissions that allow or block actions.

beginner

How do you check a user's role in Express middleware?

You create middleware that looks at the user's role stored in the request (like req.user.role) and decides if they can continue or get blocked.

intermediate

Why use middleware for RBAC in Express?

Middleware lets you check permissions before your route runs. This keeps your code clean and secure by stopping unauthorized users early.

beginner

What happens if a user tries to access a route without the right role?

The middleware sends a response like 403 Forbidden, telling the user they don’t have permission to access that resource.

intermediate

How can roles be stored and accessed in an Express app?

Roles can be stored in the user’s session, JWT token, or database. When a request comes in, middleware reads the role from these places to check permissions.

In Express, where is the best place to check user roles for access control?

A Inside route handlers

B In middleware functions

C In the database query

D In the client-side code

Middleware runs before route handlers and is the best place to check roles and permissions to block unauthorized access early.

What HTTP status code should you send when a user is not allowed to access a resource due to role restrictions?

A 200 OK

B 404 Not Found

C 401 Unauthorized

D 403 Forbidden

403 Forbidden means the user is authenticated but does not have permission to access the resource.

Which of these is NOT a common way to store user roles in an Express app?

A Local storage on client

B User session

C JWT token

D Database

Local storage on the client is not secure for storing roles because it can be modified by the user.

What is the main benefit of using RBAC in your Express app?

A Controls access based on user roles

B Simplifies user interface design

C Faster database queries

D Improves server performance

RBAC helps control what users can do by assigning roles with specific permissions.

If a user has the role 'admin', what should your RBAC middleware do?

A Ignore the role and allow all users

B Always block access

C Allow access to admin-only routes

D Redirect to login page

Admins usually have permission to access special routes, so middleware should allow them.

Explain how you would implement role-based access control in an Express app using middleware.

Think about how middleware can stop or allow requests based on user roles.

Describe why role-based access control is important for web applications.

Consider what happens if everyone could do everything in an app.

Practice

1. What is the main purpose of role-based access control (RBAC) in an Express app?

easy

A. To speed up the server response time

B. To limit user actions based on their assigned roles

C. To store user passwords securely

D. To log all user activities automatically

Solution

1. Step 1: Understand RBAC concept

   RBAC means controlling what users can do depending on their role, like admin or guest.

2. Step 2: Identify main purpose in Express

   In Express, RBAC limits access to routes or actions based on user roles to keep the app safe.

3. Final Answer:

   To limit user actions based on their assigned roles -> Option B

4. Quick Check:

   RBAC controls user permissions = A [OK]

Hint: RBAC controls what users can do by role [OK]

Common Mistakes:

• Confusing RBAC with performance optimization
• Thinking RBAC stores passwords
• Assuming RBAC logs activities automatically

2. Which of the following is the correct way to define a middleware function in Express to check if a user has the role 'admin'?

easy

A. function checkAdmin(req, res, next) { if(req.user.role === 'admin') next(); else res.status(403).send('Forbidden'); }

B. function checkAdmin(req, res) { if(req.user.role == 'admin') next(); else res.send('Forbidden'); }

C. function checkAdmin(req, res, next) { if(req.user.role = 'admin') next(); else res.status(403).send('Forbidden'); }

D. function checkAdmin(req, res, next) { if(req.user.role !== 'admin') next(); else res.status(403).send('Forbidden'); }

Solution

1. Step 1: Check middleware signature

   Middleware must have three parameters: req, res, next.

2. Step 2: Verify role check and response

   function checkAdmin(req, res, next) { if(req.user.role === 'admin') next(); else res.status(403).send('Forbidden'); } correctly compares role with 'admin' using === and calls next() if true; else sends 403 status.

3. Final Answer:

   function checkAdmin(req, res, next) { if(req.user.role === 'admin') next(); else res.status(403).send('Forbidden'); } -> Option A

4. Quick Check:

   Middleware with correct params and strict role check = D [OK]

Hint: Middleware needs (req, res, next) and strict role check [OK]

Common Mistakes:

• Using assignment (=) instead of comparison (===)
• Missing next() parameter or call
• Wrong logic reversing role check

3. Given this Express route with role check middleware, what will be the response if a user with role 'user' tries to access it?

app.get('/admin', checkAdmin, (req, res) => { res.send('Welcome Admin'); });
function checkAdmin(req, res, next) {
  if(req.user.role === 'admin') next();
  else res.status(403).send('Forbidden');
}

medium

A. 403 Forbidden status with 'Forbidden' message

B. 'Welcome Admin'

C. 500 Internal Server Error

D. 404 Not Found

Solution

1. Step 1: Analyze middleware behavior for role 'user'

   The middleware checks if role is 'admin'. Since role is 'user', condition fails.

2. Step 2: Determine response when role check fails

   Middleware sends 403 status with 'Forbidden' message and does not call next(), so route handler is skipped.

3. Final Answer:

   403 Forbidden status with 'Forbidden' message -> Option A

4. Quick Check:

   Non-admin blocked with 403 Forbidden = B [OK]

Hint: Middleware blocks non-admin with 403, no next() call [OK]

Common Mistakes:

• Assuming route handler runs for non-admin
• Confusing 403 with 404 or 500 errors
• Ignoring middleware role check logic

4. Identify the error in this Express middleware for role-based access control:

function checkRole(req, res, next) {
  if(req.user.role = 'admin') {
    next();
  } else {
    res.status(403).send('Access denied');
  }
}

medium

A. Middleware missing req and res parameters

B. Missing next() call inside the else block

C. Incorrect status code for access denial

D. Using assignment (=) instead of comparison (===) in the if condition

Solution

1. Step 1: Check the if condition syntax

   The condition uses single = which assigns 'admin' to req.user.role instead of comparing it.

2. Step 2: Understand impact of assignment in condition

   Assignment always returns truthy, so else block never runs, causing wrong behavior.

3. Final Answer:

   Using assignment (=) instead of comparison (===) in the if condition -> Option D

4. Quick Check:

   Use === for comparison, not = [OK]

Hint: Use === for comparison, not = assignment [OK]

Common Mistakes:

• Confusing assignment and comparison operators
• Forgetting to call next() in middleware
• Using wrong HTTP status codes

5. You want to protect multiple routes so only users with roles 'admin' or 'manager' can access them. Which middleware implementation correctly allows this in Express?

hard

A. function checkRoles(req, res, next) { if(req.user.role === 'admin' && req.user.role === 'manager') next(); else res.status(403).send('Forbidden'); }

B. function checkRoles(req, res, next) { if(req.user.role === 'admin' || 'manager') next(); else res.status(403).send('Forbidden'); }

C. function checkRoles(req, res, next) { if(['admin', 'manager'].includes(req.user.role)) next(); else res.status(403).send('Forbidden'); }

D. function checkRoles(req, res, next) { if(req.user.role == 'admin' || req.user.role == 'manager') next(); else res.status(404).send('Forbidden'); }

Solution

1. Step 1: Check role inclusion logic

   function checkRoles(req, res, next) { if(['admin', 'manager'].includes(req.user.role)) next(); else res.status(403).send('Forbidden'); } uses array includes() to check if role is 'admin' or 'manager', which is correct and clean.

2. Step 2: Verify status code and logic correctness

   Using && requires role to be both 'admin' and 'manager' simultaneously (impossible); condition like if(role === 'admin' || 'manager') has wrong syntax and always passes since 'manager' is truthy; using 404 instead of 403 for forbidden access is incorrect.

3. Final Answer:

   function checkRoles(req, res, next) { if(['admin', 'manager'].includes(req.user.role)) next(); else res.status(403).send('Forbidden'); } -> Option C

4. Quick Check:

   Use includes() for multiple roles and 403 status = C [OK]

Hint: Use array includes() to check multiple roles cleanly [OK]

Common Mistakes:

• Using incorrect logical operators or syntax
• Checking role equality incorrectly
• Sending wrong HTTP status code for forbidden