Node.js + Express.js User Permission Security Model

Question

We have an application that has two types of users. Depending on how the user logs in, we want them to have access to different parts of the application.

How do we i

Answer 1

You can use ability-js with everyauth, which is quite similar to CanCan for Rails https://github.com/scottkf/ability-js

Answer 2

Take a look at this list for NodeJS ACL/Permission systems. IMHO OptimalBits node_acl looks best.

Answer 3

There is now Node module permission for this. It's very easy to use, very similar to accepted answer, but still some features are added.

Answer 4

Having it per-route usually works for me. This is what I typically do:

function requireRole (role) {
    return function (req, res, next) {
        if (req.session.user && req.session.user.role === role) {
            next();
        } else {
            res.send(403);
        }
    }
}

app.get("/foo", foo.index);
app.get("/foo/:id", requireRole("user"), foo.show);
app.post("/foo", requireRole("admin"), foo.create);

// All bars are protected
app.all("/foo/bar", requireRole("admin"));

// All paths starting with "/foo/bar/" are protected
app.all("/foo/bar/*", requireRole("user"));