express-restricted is a simple Node.js package for Express.js middleware to restrict access to API endpoints with the use of JSON Web Tokens.
Installation is done through npm:
$ npm i express-restricted
or if you use yarn:
$ yarn add express-restricted
-
config- Configuration object contains properties used to target where in thereqobject should the middleware look for data.reqProp- REQUIRED,String- first child ofreqobject (body,headers, ...)childProp- OPTIONAL,String- child ofreqProp(Authorization, ...)identifier- REQUIRED,String- A property of JWT payload used to identify access rights to the endpoint.jwtKey- REQUIRED,String- containing the secret for HMAC algorithms. Used to generate the JSON Web Token. The decoded payload of the token is added to the request object asdecodedproperty.
Example:
const config = { reqProp: 'headers', childProp: 'authorization', identifier: 'user_type', jwtKey: 'ThereIsNoSecret' };
-
allow- REQUIRED,StringorArrayofStringsor an emptyArray- Used to listidentifiervalues, which are allowed to access the endpoint. An empty array will make the endpoint accessible to any identifier value. The JWT verification still has to pass.Example:
const allow = ['admin', 'maintainer'];
const express = require('express');
const restricted = require('express-restricted');
const router = express.Router();
const config = {
reqProp: 'headers',
childProp: 'authorization',
identifier: 'user_type',
jwtKey: 'ThereIsNoSecret'
};
const allow = {
all: [], // any identifier value has access
staff: ['receptionist'],
admins: ['super admin', 'admin']
};
router.get('/', restricted(config, allow.public), (req, res) => {
res.json({ msg: 'Router GET /' });
});
router.get(
'/:id/cool/:cool_id',
restricted(config, allow.admins),
(req, res) => {
res.json({ msg: 'Router GET /:id/cool/:cool_id' });
}
);
router.post('/', restricted(config, allow.staff), (req, res) => {
res.json({ msg: 'Router POST /:id' });
});
server.listen(9000);const express = require('express');
const restricted = require('express-restricted');
const router = express.Router();
const config = {
reqProp: 'headers',
childProp: 'authorization',
identifier: 'user_type',
jwtKey: 'ThereIsNoSecret'
};
const admins: ['super admin', 'admin'];
// Restricts all router endpoints to admins only
router.use(restricted(config, admins));
router.get('/', (req, res) => {
res.json({ msg: 'Router GET /' });
});
router.get(
'/:id/cool/:cool_id',
(req, res) => {
res.json({ msg: 'Router GET /:id/cool/:cool_id' });
}
);
router.post('/', (req, res) => {
res.json({ msg: 'Router POST /:id' });
});
server.listen(9000);
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent