CODEWITHSUNDEEP
node.jsrestexpressget
user2302725
user2302725

Reputation: 473

How can I protect a express route without authentication?

I'm trying to implement a GET method with Express in my nodeJs application. I'd like to do something like this in order to display user data :

router.get("/user/:idUser", (req, res) => {

The user doesn't need to be authenticated in order to execute this code. However I don't want that anybody can execute this request with a user id of someone else. Because he could see data he's not supposed to see.

How could I proceed ? I thought about using some encryption process to have something like :

/user/PdfgdfJFDGTfrfgdsf

Upvotes: 1

Views: 1124

Answers (2)

jfriend00
jfriend00

Reputation: 708056

Your question isn't really making sense. You don't want authentication, but you only want a user to be able to view their own data so nobody else can view it.

The ONLY way to solve that is by using some form of authentication. The user has to prove to the server that they are allowed to view that data before the user renders the page for them.

Yes, you could obscure the URL (make it some mostly unguessable string of characters), but it's not clear what problem that is solving. The user themselves won't be able to remember it or type it so it would probably have to be a link in a web page and if it's a link in an unauthenticated web page, then anyone can get to it - thus defeating the purpose.

There are cases where temporary links (often done for privileged downloads) such as what you mention /user/PdfgdfJFDGTfrfgdsf are sent via an authenticated channel (either an authenticated webpage or sent to an email address known to belong to an authenticated user) and these links contain some unique and hard to guess code. The user can then click on that link (in authenticated webpage or in email) and access that resource without further authentication. In that case, the knowledge of the code in the URL is serving as a form of proof of authentication. Because URLs may be logged in service providers or corporate infrastructure and thus not remain entirely private, this technique has its limitations and is typically only used for short term (download this resource in the next 10 minutes) type of uses, not a long term substitute for authentication and not used for things that demand real security. You don't explain enough of your use case to know whether this is practical for your situation or not.

The user doesn't need to be authenticated in order to execute this code. However I don't want that anybody can execute this request with a user id of someone else. Because he could see data he's not supposed to see.

That's an inconsistent statement. You say "user doesn't need to be authenticated in order to execute this code" and then you say "I don't want that anybody can execute this request with a user id of someone else.". You can't have both. The user is either required to prove authorization or they aren't. Pick one. It can't be both.

Upvotes: 1

Tuan Anh Tran
Tuan Anh Tran

Reputation: 7267

you can use jwt for this and a auth middleware for this

upon decoding jwt token, you can implement logic to check if the decodedToken.user_id (given that you add user_id when encode token payload) is equal to the :idUser in route (or any kind of logic you want) there.

Upvotes: 0

Related Questions