node.js - Using Passport to authenticate based on dynamic route -

node.js - Using Passport to authenticate based on dynamic route -

i'm building api node.js, , have endpoints want secure.

for simplicity let's assume i'm using http basic authentication (passport-http) of endpoints.

what i'd on top of that, create sure route this: api.example.com/users/:uid/ accessible user id.

i can this:

app.get('/users/:uid', passport.authenticate('basic', { session: false }), function (req, res, next) { if (req.params.uid !== user.id) { homecoming next(new error('unauthorized')); } homecoming next(); }, function (req, res, next) { // secret stuff } );

but wonder if there's way without adding additional middleware, using passport itself:

app.get('/users/:uid', passport.authenticate( ??? ), function (req, res, next) { // secret stuff } );

is possible? if not, there improve way?

you can seek perhaps this. general description: authenticate requests nail under /users route requiring authentication. on specific route, utilize middleware makes sure user trying access specific route 1 in route via uid.

function authorizeuser(req, res, next) { if (req.user.uid !== req.params.uid) next(new error('not profile!')); next(); } // require login entire /users section app.use('/users', passport.authenticate('basic', { session: false })); // authorize /users/:uid section 1 user app.use('/users/:uid', authorizeuser); // nested routes secured middleware above. app.get('/users/:uid', function (req, res) { // secret stuff }); app.get('/users/:uid/foo/bar', function (req, res) { // secret });

if you're securing 1 endpoint, can set on same route.

node.js authentication express passport.js