Currently, I am developing a voting application that includes a feature for authenticated users to delete and edit their own polls using Passport JS authentication.
My Passport setup with Node/Express looks like this:
passport.use(new FacebookStrategy({
clientID: FACEBOOK_APP_ID,
clientSecret: FACEBOOK_APP_SECRET,
callbackURL: CALLBACK_URL
}, function(accessToken, refreshToken, profile, done){
//callback function after login
process.nextTick(function(){
done(null, profile);
});
}));
passport.serializeUser(function(user,done){
req.session.passport.user = {};
done(null, user);
});
passport.deserializeUser(function(id, done){
done(null, id);
});
app.get('/auth/facebook', passport.authenticate('facebook'));
app.get('/auth/facebook/callback', passport.authenticate('facebook', {
successRedirect: '/',
failureRedirect: '/error'
}));
app.get('/success', function(req, res, next) {
res.send('Successfully logged in. You can close this window');
});
app.get('/error', function(req, res, next) {
res.send("Error logging in.");
});
Hence, every request now carries the user information (req.user) including the id and displayName
To secure a route server-side, I utilize the following middleware function:
var auth = function(req,res,next){
if(!req.isAuthenticated()){
console.log("You need to login!");
res.sendStatus(401);
}
else {
console.log("User is logged in, success!");
next();
}
};
The format used for storing polls in MongoDB is as follows:
{
"_id": {
"$oid": "57c69ec65ed24f166b4e98cf"
},
"title": "Poll Test",
"options": [
{
"option": "Option1",
"votes": 0
},
{
"option": "Option2",
"votes": 0
},
{
"option": "Option3",
"votes": 0
},
{
"option": "Option4",
"votes": 0
}
],
"userID": "1798846357",
"displayName": "John Doe",
"date": "Wed Aug 31 2016 09:09:26 GMT+0000 (UTC)"
}
In order to protect a specific route in my REST API, particularly for actions like deleting a poll from the front-end, it's important to validate if the user requesting is not only authenticated but also owns the poll. However, implementing this check by comparing the userID in the request with the one in the database has been challenging.
I attempted to incorporate an if statement within the db.collection function to verify if req.user.id and doc.data.id align, but encountered difficulties due to the timing of updateOne.
If you have any insights on how to retrieve the poll based on userID and verify its match with req.user.id before proceeding with the update, please share your thoughts!
app.delete("/polls/:id", auth, function(req, res) {
db.collection(POLLS_COLLECTION).deleteOne({
_id: new ObjectID(req.params.id)
}, function(err, doc) {
if (err) {
handleError(res, err.message, "Failed to delete contact");
} else {
res.status(204).end();
}
});
});
});