Determining How To Authorize with NodeJS/Mongoose
I am working on a NodeJS/express application using passportJS for sign in/sign up. I have defined a user model for all users, but want only certain users within my administration to have access to editing certain models. I was thinking of adding a boolean field, like isAdmin to determine this, but I don't know how I would verify admin users. To be specific, how would I determine when I need to generate a token for the admin user? How do I differentiate users in my administrations from ordinary users? I was thinking of having a separate locally hosted website that connects to the same database that I could use to manage models only from my computer. Would that work?
Any help would be greatly appreciated!
Thanks!
node.js express authentication mongoose passport.js
asked Nov 28 '18 at 2:10
user10365692user10365692
11
add a comment |
I am working on a NodeJS/express application using passportJS for sign in/sign up. I have defined a user model for all users, but want only certain users within my administration to have access to editing certain models. I was thinking of adding a boolean field, like isAdmin to determine this, but I don't know how I would verify admin users. To be specific, how would I determine when I need to generate a token for the admin user? How do I differentiate users in my administrations from ordinary users? I was thinking of having a separate locally hosted website that connects to the same database that I could use to manage models only from my computer. Would that work?
Any help would be greatly appreciated!
Thanks!
node.js express authentication mongoose passport.js
asked Nov 28 '18 at 2:10
user10365692user10365692
11
add a comment |
I am working on a NodeJS/express application using passportJS for sign in/sign up. I have defined a user model for all users, but want only certain users within my administration to have access to editing certain models. I was thinking of adding a boolean field, like isAdmin to determine this, but I don't know how I would verify admin users. To be specific, how would I determine when I need to generate a token for the admin user? How do I differentiate users in my administrations from ordinary users? I was thinking of having a separate locally hosted website that connects to the same database that I could use to manage models only from my computer. Would that work?
Any help would be greatly appreciated!
Thanks!
node.js express authentication mongoose passport.js
asked Nov 28 '18 at 2:10
user10365692user10365692
11
I am working on a NodeJS/express application using passportJS for sign in/sign up. I have defined a user model for all users, but want only certain users within my administration to have access to editing certain models. I was thinking of adding a boolean field, like isAdmin to determine this, but I don't know how I would verify admin users. To be specific, how would I determine when I need to generate a token for the admin user? How do I differentiate users in my administrations from ordinary users? I was thinking of having a separate locally hosted website that connects to the same database that I could use to manage models only from my computer. Would that work?
Any help would be greatly appreciated!
Thanks!
node.js express authentication mongoose passport.js
node.js express authentication mongoose passport.js
asked Nov 28 '18 at 2:10
user10365692user10365692
11
asked Nov 28 '18 at 2:10
user10365692user10365692
11
edited Nov 28 '18 at 2:52
user10365692
asked Nov 28 '18 at 2:10
user10365692user10365692
11
asked Nov 28 '18 at 2:10
user10365692user10365692
11
asked Nov 28 '18 at 2:10
user10365692user10365692
11
11
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
There are many option available. i can explain you some of them.
1) As you said you can define boolean field as is Admin true of false.
-> if you are using this option and you are using passport. You must get user in your request object.Before hitting api or particular endpoint you can set middleware to verify that requested user is admin or user.
file
Filename : ../services/auth.service.js
exports.isAdmin = async (req, res, next) => {
// req.user is object that you will get after successfull login. change accordingly
// Or you can check from db also. Get object logged in user from db by their email id.
// And check condition
// Check Role if admin or not
if(req.user.isAdmin) {
next(); // If verify it will redirect to next process
} else {
return res.status(401).json({
Error: true,
message: 'You are not authorized to perform this action.',
})
}
};
You can use this function as middleware.
const auth = require('../services/auth.service.js')
router.get('/*', auth.isAdmin, (req, res) => {
res.status(200).json({ message: "Hello from Admin side."})
});
Visit : https://github.com/mihir-kanzariya/Nodejs-CRUD
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53511071%2fdetermining-how-to-authorize-with-nodejs-mongoose%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
There are many option available. i can explain you some of them.
1) As you said you can define boolean field as is Admin true of false.
-> if you are using this option and you are using passport. You must get user in your request object.Before hitting api or particular endpoint you can set middleware to verify that requested user is admin or user.
file
Filename : ../services/auth.service.js
exports.isAdmin = async (req, res, next) => {
// req.user is object that you will get after successfull login. change accordingly
// Or you can check from db also. Get object logged in user from db by their email id.
// And check condition
// Check Role if admin or not
if(req.user.isAdmin) {
next(); // If verify it will redirect to next process
} else {
return res.status(401).json({
Error: true,
message: 'You are not authorized to perform this action.',
})
}
};
You can use this function as middleware.
const auth = require('../services/auth.service.js')
router.get('/*', auth.isAdmin, (req, res) => {
res.status(200).json({ message: "Hello from Admin side."})
});
Visit : https://github.com/mihir-kanzariya/Nodejs-CRUD
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
add a comment |
There are many option available. i can explain you some of them.
1) As you said you can define boolean field as is Admin true of false.
-> if you are using this option and you are using passport. You must get user in your request object.Before hitting api or particular endpoint you can set middleware to verify that requested user is admin or user.
file
Filename : ../services/auth.service.js
exports.isAdmin = async (req, res, next) => {
// req.user is object that you will get after successfull login. change accordingly
// Or you can check from db also. Get object logged in user from db by their email id.
// And check condition
// Check Role if admin or not
if(req.user.isAdmin) {
next(); // If verify it will redirect to next process
} else {
return res.status(401).json({
Error: true,
message: 'You are not authorized to perform this action.',
})
}
};
You can use this function as middleware.
const auth = require('../services/auth.service.js')
router.get('/*', auth.isAdmin, (req, res) => {
res.status(200).json({ message: "Hello from Admin side."})
});
Visit : https://github.com/mihir-kanzariya/Nodejs-CRUD
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
add a comment |
There are many option available. i can explain you some of them.
1) As you said you can define boolean field as is Admin true of false.
-> if you are using this option and you are using passport. You must get user in your request object.Before hitting api or particular endpoint you can set middleware to verify that requested user is admin or user.
file
Filename : ../services/auth.service.js
exports.isAdmin = async (req, res, next) => {
// req.user is object that you will get after successfull login. change accordingly
// Or you can check from db also. Get object logged in user from db by their email id.
// And check condition
// Check Role if admin or not
if(req.user.isAdmin) {
next(); // If verify it will redirect to next process
} else {
return res.status(401).json({
Error: true,
message: 'You are not authorized to perform this action.',
})
}
};
You can use this function as middleware.
const auth = require('../services/auth.service.js')
router.get('/*', auth.isAdmin, (req, res) => {
res.status(200).json({ message: "Hello from Admin side."})
});
Visit : https://github.com/mihir-kanzariya/Nodejs-CRUD
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
There are many option available. i can explain you some of them.
1) As you said you can define boolean field as is Admin true of false.
-> if you are using this option and you are using passport. You must get user in your request object.Before hitting api or particular endpoint you can set middleware to verify that requested user is admin or user.
file
Filename : ../services/auth.service.js
exports.isAdmin = async (req, res, next) => {
// req.user is object that you will get after successfull login. change accordingly
// Or you can check from db also. Get object logged in user from db by their email id.
// And check condition
// Check Role if admin or not
if(req.user.isAdmin) {
next(); // If verify it will redirect to next process
} else {
return res.status(401).json({
Error: true,
message: 'You are not authorized to perform this action.',
})
}
};
You can use this function as middleware.
const auth = require('../services/auth.service.js')
router.get('/*', auth.isAdmin, (req, res) => {
res.status(200).json({ message: "Hello from Admin side."})
});
Visit : https://github.com/mihir-kanzariya/Nodejs-CRUD
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
answered Nov 28 '18 at 5:00
Mihir KanzariyaMihir Kanzariya
244
244
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
add a comment |
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
Thank you for your answer! But, I am still confused as to how I determine if the user is an administrator or not in order to be able to set the isAdmin boolean to True or False.
– user10365692
Dec 1 '18 at 23:10
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53511071%2fdetermining-how-to-authorize-with-nodejs-mongoose%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
