Intercepting headers on NodeJS (Express) before routing in a global scope - node.js

Question

I've a code like this on my server.js
var session = {
v1: require('./routes/v1/session')
}
app.post('/v1/session/login', session.v1.login);
app.get('/v1/session/logout/:uuid', session.v1.logout);
var modify = {
v1: require('./routes/v1/modify')
}
app.put('/v1/modify/:uuid/password', modify.v1.password);
app.put('/v1/modify/:uuid/mobile', modify.v1.mobile);
app.put('/v1/modify/:uuid/email', modify.v1.email);
All the cases above I am sending an Authorization header with a token, except for Login because you will receive a token after the login.
So, in all of my routes, I need to call a routine to validate the token and then perform the operations. Like this:
exports.logout = function (req, res) {
var auth = req.headers.authorization;
global.utils.validateToken(auth).then(function(uuid) {
// Code here
}
}
But I am pretty convinced that there is a better way to do that. Something like execute an authorization check for each server request before call the router.
Is such thing possible ? And if yes: Can I define exceptions (for example...in case of Login, I don't need to check the Authorization) ?
thanks !

Answer 1

There are multiple ways to do so, I am stating three approaches, you can go with whichever you like.
So basically, you need to make a middleware which should not be called while login.
what you will do is, make a middleware as given below:
var middleware = {
authTokenValidator = function(req, res, next) {
var auth = req.headers.authorization;
global.utils.validateToken(auth).then(function(uuid) {
// Token Valid Code here
next();
}).catch(function(err) {
// Token failure handling code here
res.status(401).json(err);
})
}
}
now you can use this middleware two ways:
First is using middleware for the routes wherever needed.. as written below:
var session = {
v1: require('./routes/v1/session')
}
// Skipped for login
app.post('/v1/session/login', session.v1.login);
app.get('/v1/session/logout/:uuid', middleware.authTokenValidator, session.v1.logout);
var modify = {
v1: require('./routes/v1/modify')
}
app.put('/v1/modify/:uuid/password', middleware.authTokenValidator, modify.v1.password);
app.put('/v1/modify/:uuid/mobile', middleware.authTokenValidator, modify.v1.mobile);
app.put('/v1/modify/:uuid/email', middleware.authTokenValidator, modify.v1.email);
so basically using next function you can pass any number of functions as middleware and call next middleware function.
The second way is passing middleware globally and handle exceptions like login URL:
define all the routes above middleware which should not go through middleware and others below middleware as below code for reference:
var session = {
v1: require('./routes/v1/session')
}
// Skipped for login
app.post('/v1/session/login', session.v1.login);
// All the requests except the above path will go throgh this middleware
app.use(middleware.authTokenValidator)
app.get('/v1/session/logout/:uuid', session.v1.logout);
var modify = {
v1: require('./routes/v1/modify')
}
app.put('/v1/modify/:uuid/password', modify.v1.password);
app.put('/v1/modify/:uuid/mobile', modify.v1.mobile);
app.put('/v1/modify/:uuid/email', modify.v1.email);
and, the Third approach is similar to the Second one but checking request path in middleware and skip it, which is not preferable...
var middleware = {
authTokenValidator = function(req, res, next) {
var no_validate_path = ['/v1/session/login']
// Skipping the login path here
if (no_validate_path.indexOf(req.path) >= 0) {
next()
} else {
var auth = req.headers.authorization;
global.utils.validateToken(auth).then(function(uuid) {
// Token Valid Code here
next();
}).catch(function(err) {
// Token failure handling code here
res.status(401).json(err);
})
}
}
}
And your route code as:
//Adding middleware for all the paths
app.use(middleware.authTokenValidator)
var session = {
v1: require('./routes/v1/session')
}
app.post('/v1/session/login', session.v1.login);
app.get('/v1/session/logout/:uuid', session.v1.logout);
var modify = {
v1: require('./routes/v1/modify')
}
app.put('/v1/modify/:uuid/password', modify.v1.password);
app.put('/v1/modify/:uuid/mobile', modify.v1.mobile);
app.put('/v1/modify/:uuid/email', modify.v1.email);
References to read about middlewares https://expressjs.com/en/guide/using-middleware.html