Lesson 07 · 11 min
Protected routes and roles
One middleware finds out who came, the next decides whether they're allowed.
Authentication answers "who are you?", authorization answers "what may you do?". In Express these are two middleware. The first reads the session or token and puts the user in req.user, or responds with 401. The second checks the role or resource owner and responds with 403. The route simply lists the middleware it needs before the handler.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.