Protecting Express Routes with the protect Middleware

The protect middleware is the gateway to every authenticated route in your Express API. It runs before route handlers for protected endpoints, extracts the JWT from the Authorization header, verifies it, fetches the current user from MongoDB, and attaches them to req.user. The route handler then has access to the authenticated user without repeating any auth logic. In this lesson you will build the complete protect middleware, an authorize factory for role-based access control, and verify every scenario — valid token, expired token, missing token, and insufficient permissions.

The protect Middleware — Complete Implementation #

// server/src/middleware/auth.js
const User              = require('../models/User');
const AppError          = require('../utils/AppError');
const { verifyAccessToken } = require('../utils/jwt');

const protect = async (req, res, next) => {
  try {
    // ── 1. Extract token from Authorization header ─────────────────────────
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      throw new AppError('No token provided — please log in', 401);
    }
    const token = authHeader.split(' ')[1]; // 'Bearer <token>' → '<token>'

    // ── 2. Verify the token — throws if invalid or expired ─────────────────
    const decoded = verifyAccessToken(token); // throws TokenExpiredError or JsonWebTokenError

    // ── 3. Fetch the current user from MongoDB ─────────────────────────────
    // Always fetch from DB — the token payload may be stale (role changed etc.)
    const user = await User.findById(decoded.id).select('-password');
    if (!user) {
      // Token was valid but the user was deleted after it was issued
      throw new AppError('User no longer exists', 401);
    }

    // ── 4. Check if user changed password after token was issued ───────────
    // (Optional but recommended for high-security apps)
    // if (user.passwordChangedAt && decoded.iat < user.passwordChangedAt.getTime() / 1000) {
    //   throw new AppError('Password changed — please log in again', 401);
    // }

    // ── 5. Attach user to request — available in all downstream handlers ───
    req.user = user;
    next(); // proceed to the route handler

  } catch (err) {
    next(err); // passes TokenExpiredError / JsonWebTokenError / AppError to errorHandler
  }
};

module.exports = protect;

The authorize Middleware — Role-Based Access Control #

// server/src/middleware/authorize.js
// Factory function: returns middleware that allows only specified roles
const AppError = require('../utils/AppError');

const authorize = (...allowedRoles) => {
  return (req, res, next) => {
    // protect must run before authorize — req.user must be set
    if (!req.user) {
      return next(new AppError('Not authenticated', 401));
    }

    if (!allowedRoles.includes(req.user.role)) {
      return next(
        new AppError(
          `Role '${req.user.role}' is not authorised to access this route`,
          403
        )
      );
    }

    next(); // user has the required role — proceed
  };
};

module.exports = authorize;

// ── Usage in routes ────────────────────────────────────────────────────────────
// server/src/routes/admin.js
const protect   = require('../middleware/auth');
const authorize = require('../middleware/authorize');

// Any authenticated user
router.get('/me', protect, getMe);

// Only editors and admins
router.post('/posts', protect, authorize('editor', 'admin'), createPost);

// Admin only
router.delete('/users/:id', protect, authorize('admin'), deleteUser);
router.get('/stats',        protect, authorize('admin'), getAdminStats);

Owner-Only Access — Beyond Role Checks #

// Some resources are only accessible to their owner (or an admin)
// Check ownership inside the controller — not in middleware

const updatePost = asyncHandler(async (req, res) => {
  const post = await Post.findById(req.params.id);
  if (!post) throw new AppError('Post not found', 404);

  // Check: is the current user the post owner, or an admin?
  const isOwner = post.author.toString() === req.user.id;
  const isAdmin = req.user.role === 'admin';

  if (!isOwner && !isAdmin) {
    throw new AppError('Not authorised to update this post', 403);
  }

  // Proceed with update
  const updates = { title: req.body.title, body: req.body.body };
  const updated = await Post.findByIdAndUpdate(req.params.id, { $set: updates },
    { new: true, runValidators: true });
  res.json({ success: true, data: updated });
});

Testing Auth Routes with Postman #

1. POST /api/auth/login  → get token
   Body: { "email": "user@example.com", "password": "Test@1234" }
   Response: { "token": "eyJ..." }

2. GET /api/auth/me  → verify token works
   Authorization: Bearer eyJ...
   Expected: 200 { "data": { "_id": "...", "name": "...", "role": "user" } }

3. GET /api/auth/me  → verify expired/invalid token fails
   Authorization: Bearer invalidtoken
   Expected: 401 { "message": "Invalid token — please log in again" }

4. POST /api/posts  → verify protect works
   No Authorization header
   Expected: 401 { "message": "No token provided — please log in" }

5. DELETE /api/users/123  → verify authorize works (as non-admin)
   Authorization: Bearer <user token>
   Expected: 403 { "message": "Role 'user' is not authorised..." }

Common Mistakes #

Mistake 1 — Not running protect before authorize #

❌ Wrong — authorize tries to read req.user which is not set:

router.delete('/users/:id', authorize('admin'), deleteUser);
// authorize runs first — req.user is undefined → crash or wrong error

✅ Correct — protect always comes before authorize:

router.delete('/users/:id', protect, authorize('admin'), deleteUser); // ✓

Mistake 2 — Comparing ObjectId and string without .toString() #

❌ Wrong — ObjectId !== string even if they represent the same ID:

if (post.author === req.user.id) { ... }
// post.author is a Mongoose ObjectId, req.user.id is a string — always false!

✅ Correct — convert to string for comparison:

if (post.author.toString() === req.user.id) { ... } // ✓

Mistake 3 — Using 401 instead of 403 for authorisation failures #

❌ Wrong — returning 401 when a user is authenticated but lacks permission:

throw new AppError('Not allowed', 401); // 401 = not authenticated

✅ Correct — use the semantically correct status codes:

// 401 Unauthorized = not authenticated (no token or invalid token)
// 403 Forbidden    = authenticated but not permitted
throw new AppError('Not authorised to access this route', 403); // ✓

Quick Reference #