jwt prevents me from seeing other users' profiles nodejs, angular - node.js

Question

I followed a tutorial on how to create an authentication system. I tried to understand as much as possible while following the tutorial, but there are things that I still don't get, and now I've come to a problem that I've tried many things to fix but the answer is still negative. The problem is that the jwt middleware only allows me to see the profile of the user that I am logged in as, but I don't want that, I want a user to be able to see every other users' profiles, how can I do that? Thanks in advance!!
For the backend, here is my "user.route.js"
router.get("/profile/:id",auth, async (req, res) => {
try {
// request.user is getting fetched from Middleware after token authentication
const user = await User.findById(req.user.id);
res.json(user);
} catch (e) {
res.send({ message: "Error in Fetching user" });
}
});
for front end, here is my "authentication.service.ts"
export interface UserDetails{
username: string
email: string
password: string
firstName: string
lastName: string
exp: number
iat: number
}
interface TokenResponse{
token: string
}
export interface TokenPayload{
username: string
email: string
password: string
firstName: string
lastName: string
}
#Injectable({
providedIn: 'root'
})
export class AuthenticationService {
private token: string
constructor(private http: HttpClient, private router: Router) {}
private saveToken(token: string): void{
localStorage.setItem('usertoken', token)
this.token = token
}
private getToken(): string{
if(!this.token){
this.token = localStorage.getItem('usertoken')
}
return this.token
}
public getUserDetails(): UserDetails{
const token = this.getToken()
let payload
if(token){
payload = token.split('.')[1]
payload = window.atob(payload)
return JSON.parse(payload)
}else{
return null
}
}
public isLoggedIn(): boolean{
const user = this.getUserDetails()
if(user){
return user.exp > Date.now()/ 1000
}
else{
return false
}
}
public login(user: TokenPayload): Observable<any>{
const base = this.http.post('/user/login', user)
const request = base.pipe(
map((data: TokenResponse) => {
if(data.token){
this.saveToken(data.token)
}return data
})
)
return request
}
public register(user: TokenPayload) : Observable<any>{
const base = this.http.post('/user/register', user)
const request = base.pipe(
map((data: TokenResponse) => {
if(data.token){
this.saveToken(data.token)
}
return data
})
)
return request
}
public profile(id): Observable<any>{
const username = this.getUserDetails().username
return this.http.get(`/user/profile/${id}`,
{
headers: {Authorization: `${this.getToken()}`}
})
}
public logout(): void{
this.token = ''
window.localStorage.removeItem('usertoken')
this.router.navigateByUrl('/')
}
}
and this is the "profile.component.ts" code
ngOnInit() {
this.route.params.subscribe(params => {
const id = params.id;
this.auth.profile(id).subscribe(
user => {
this.details = user
},
err => {
console.error(err)
}
)
})
}

Answer 1

req.user up there is filled in by the authorization middleware, it does not use the id from url path like you want. For that you should use req.params.id