Express protect only select endpoints

Help
,
1

Hello, I want to protect only POST and DELETE endpoints on my api and leave the GET ones public. Is there a way to achieve this using the express-oauth2-jwt-bearer library?

3

Hey there @vdemcak welcome to the community!

You can absolutely achieve this with express-oauth2-jwt-bearer - You more or less just need to include checks on the access token for protected endpoints while omitting them for public endpoints. For example:

//Using claimIncludes to check if the permissions claim contains read:msg
app.get('/api/external', checkJwt, claimIncludes('permissions', 'read:msg'), (req, res) => {
  res.json({ message: `Hello ${req.auth.payload.sub} - Permissions: ${req.auth.payload.permissions}` });
});

//Public endpoint
app.get('/api/external/public', (req, res) => {
    res.json({ message: `Hello - This is a public endpoint, welcome!` });
  });

//Protected, requires create:msg permission
app.post('/api/external/create', checkJwt, claimIncludes('permissions', 'create:msg'), (req, res) => {
  res.json({message: `Hello ${req.auth.payload.sub} - Successful POST` })
});

In this case, checkJWT is an instance of the auth middleware. You can choose to be more granular with claimIncludes, requiredScopes, etc. The API reference can be found here:

Hope this helps!

4

Thanks! Worked like a charm!

1 Like
5

Awesome! Thanks for confirming :rocket:

6

Quick question, how would I go on about checking if valid token was provided and it if has claims inside of a request? I would like to add entries to the response based on if a valid token has been provided and it has the required claims.