# Express protect only select endpoints

**URL:** <https://community.auth0.com/t/express-protect-only-select-endpoints/102372>\
**Category:** Get Help\
**Tags:** configuration, application\
**Created:** [March 12, 2023, 8:05pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372 "2023-03-12T20:05:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vdemcak](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vdemcak/32/45377_2.png) [@vdemcak](https://community.auth0.com/u/vdemcak)\
**Post date:** [March 12, 2023, 8:05pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372/1 "2023-03-12T20:05:17Z")

</div>

Hello, I want to protect only POST and DELETE endpoints on my api and leave the GET ones public. Is there a way to achieve this using the express-oauth2-jwt-bearer library?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [March 17, 2023, 10:21pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372/3 "2023-03-17T22:21:46Z")

</div>

Hey there @vdemcak welcome to the community!

> [@vdemcak](#):
>
> Is there a way to achieve this using the express-oauth2-jwt-bearer library?

You can absolutely achieve this with [express-oauth2-jwt-bearer](https://github.com/auth0/node-oauth2-jwt-bearer/tree/main/packages/express-oauth2-jwt-bearer#api-reference) - You more or less just need to include checks on the access token for protected endpoints while omitting them for public endpoints. For example:

```auto
//Using claimIncludes to check if the permissions claim contains read:msg
app.get('/api/external', checkJwt, claimIncludes('permissions', 'read:msg'), (req, res) => {
  res.json({ message: `Hello ${req.auth.payload.sub} - Permissions: ${req.auth.payload.permissions}` });
});

//Public endpoint
app.get('/api/external/public', (req, res) => {
    res.json({ message: `Hello - This is a public endpoint, welcome!` });
  });

//Protected, requires create:msg permission
app.post('/api/external/create', checkJwt, claimIncludes('permissions', 'create:msg'), (req, res) => {
  res.json({message: `Hello ${req.auth.payload.sub} - Successful POST` })
});

```

In this case, `checkJWT` is an instance of the [auth](https://auth0.github.io/node-oauth2-jwt-bearer/#auth) middleware. You can choose to be more granular with `claimIncludes`, `requiredScopes`, etc. The API reference can be found here:

> <https://github.com/auth0/node-oauth2-jwt-bearer/tree/main/packages/express-oauth2-jwt-bearer#api-reference>
>
> //github.com/auth0/node-oauth2-jwt-bearer/tree/main/packages/express-oauth2-jwt-bearer

Hope this helps!

---

<div class="post-metadata">

**Author:** ![vdemcak](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vdemcak/32/45377_2.png) [@vdemcak](https://community.auth0.com/u/vdemcak)\
**Post date:** [March 17, 2023, 11:00pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372/4 "2023-03-17T23:00:02Z")

</div>

Thanks! Worked like a charm!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [March 17, 2023, 11:26pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372/5 "2023-03-17T23:26:18Z")

</div>

Awesome! Thanks for confirming 🚀

---

<div class="post-metadata">

**Author:** ![vdemcak](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vdemcak/32/45377_2.png) [@vdemcak](https://community.auth0.com/u/vdemcak)\
**Post date:** [March 22, 2023, 10:42pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372/6 "2023-03-22T22:42:27Z")

</div>

Quick question, how would I go on about checking if valid token was provided and it if has claims inside of a request? I would like to add entries to the response based on if a valid token has been provided and it has the required claims.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 5, 2023, 10:42pm UTC](https://community.auth0.com/t/express-protect-only-select-endpoints/102372/7 "2023-04-05T22:42:48Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.