How To Manage User Roles In Node.js
Why Stack Overflow recommends it
Stack Overflow users link it when asking or answering how to implement role-based access control and admin/user permissions in Node.js and Express apps.
Recommended by 2 people across 2 different months, 2021 to 2022.
What it is
A Web Dev Simplified tutorial by Kyle Cook on building a flexible user permission and role system in a Node.js app. It covers authentication handling, role-based permissions and scoped routes, with starting and finished code on GitHub.
What people said
Recommends Anh Nhat Tran · 2021-02 · Stack Overflow · on “How to manage access control with roles to not allow a basic user to be able to update an account which is not owned”
Since You should use updateAny instead of updateOwn . The idea behind this trick is you let admin role with full power to access this route then add conditions to check for other small cases such as user update his/her own data. router.put( "/:userId", Auth.allowIfLoggedin, // Use updateAny instead of updateOwn Auth.grantAccess("updateAny", "user"), UserCtrl.updateUser ); Then, check for userId in grantAccess function as below. // Allowing access to right role permission const grantAccess = (action, resource) => { return async (req, res, next) => { try { const modifiedAction = action; // Check for userId and modify action from updateAny to updateOwn // when current user updates his/her own i
Recommends Ankush Dogra · 2021-07 · Stack Overflow · on “Express GET error Requested URL not found”
@sarah correct me if I am wrong but you are saying If a **client can go to database and check itself admin** doesn't that makes your website vulnerable. Like, a normal user can edit or completely delete your websites data. I don't know about python but there are many good tutorials on youtube about that like : [this video]
Cites John Oliver · 2022-08 · Stack Overflow · on “Role based access control in node.js”
I want to implement the user and admin roles and permissions in node.js. I have watched the video of web-dev-simplified ( Link [this video] ) I quite liked that approach but in the example he is using JSON file to store the users data. In my case I am storing user data in MongoDB database. In the user schema I have a field called role which is as following. role: { type: String, enum: ["admin", "user"], default: "user", } How can I go on from here. This is the JWT auhentication function. module.exports = middlewares = { authenticateToken: async (req, res, next) => { try { if (!req.headers["x-access-token"]) { return res.status(401).json({ error: "Key x-access-token not found", }); } if (req.heade