Expressjs - How to prevent a user from posting a registration form...? - node.js

Question

Is the following an appropriate way to redirect a user if they are trying to POST data to the registration form if they are already logged in or is there a better more secure way? I am preventing them from a GET request to the registration form, but I also want to prevent them from making a POST request thought other means then a form.
The check is:
if(true !== req.session.loggedIn){
}else{
}
In the app.js file:
app.get('/register',register.registration);
app.post('/register',register.doRegistration);
This is the controller file:
var mongoose = require('mongoose');
var User = mongoose.model('User');
exports.registration = function(req,res){
//Redirect the user if they are logged in
if(true !== req.session.loggedIn){
res.render('register', {
});
}else{
res.redirect('/user');
}
}
exports.doRegistration = function(req,res){
//Redirect the user if they are logged in
if(true !== req.session.loggedIn){
User.create({
fullName: req.body.register.fullName,
email: req.body.register.email,
password: req.body.register.password,
createdOn: Date.now()
}, function(err, user){
if(err){
console.log(err);
res.redirect('/register');
}else{
console.log('success');
req.session.user = {
"name": user.fullName,
"email": user.email,
"_id": user._id
};
req.session.loggedIn = true;
res.redirect('/user');
}
});
}else{
res.redirect('/user');
}
}

Answer 1

Firstly, instead of repeating yourself for each route you could simply use some middleware to check if a user is logged in or not and add any logic there:
function ensureNewUser(req, res, next) {
if (req.session.loggedIn) {
// if user is logged in redirect to /user
res.redirect('/user');
} else {
// else next
next();
}
}
Then use that middleware in your route definitions:
app.get('/register', ensureNewUser, register.registration);
app.post('/register',ensureNewUser, register.doRegistration);
Not completely sure what you mean by "more secure way", hard to comment without knowing how you are handling authentication but by "prevent them from making a POST request thought other means then a form" I assume you are talking about CSRF. In which case you should ensure you are using some CSRF middleware app.use(express.csrf()); or if using Express4 something like the csurf module and then ensuring you are sending back the token in the request from your front end.