How to integrate a Express Backend with an Auth0 frontend for controlled access to server routes?

[tyf]

Hello @michaelnicol71 welcome to the community!

@michaelnicol71

How can I secure my express backend routes such that only certain users can access them?

I recommend checking out the express-oauth2-jwt-bearer package - Here’s a quickstart which should be helpful and FWIW our react sample uses this package as well.

@michaelnicol71

My idea is that each backend route requires a user token, passed as a URL param, to access. I then use auth0 on the backend to figure out who this user is, and I then check the MongoDB database to see the user’s permissions. If the user’s permissions allow them to access this server route, I complete the task for that route.

This sounds about right! Just make sure you are passing an access token as opposed to ID token.