# Web app authorization acc to role assigned **URL:** \ **Category:** Get Help\ **Tags:** apis, application\ **Created:** [October 18, 2023, 11:13am UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804 "2023-10-18T11:13:04Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nalawalaq](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nalawalaq/32/51743_2.png) [@nalawalaq](https://community.auth0.com/u/nalawalaq)\ **Post date:** [October 18, 2023, 11:13am UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/1 "2023-10-18T11:13:04Z")
I have CRUD web application with a tech stack of mongodb, nodejs, express and ejs. I am using auth0 for user authentication to access the web app. i want to perform role based authorization so that only certain users can access the certain functionalities. How do i implement this? i.e. if the role assigned to the user is Admin, the edit and add buttons on the web app will be available else, the buttons will be disabled async function getUserRolesFromAuth0(userId) { const options = { method: “GET”, url: `https://samcomelectronics.us.auth0.com/api/v2/users/${userId}/roles`, headers: { Authorization: "Bearer " + process.env.AUTH0\_TOKEN, }, }; try { const response = await axios.request(options); if (response.data && Array.isArray(response.data) && response.data.length \> 0) { const roles = response.data.map((role) =\> role.name); console.log(roles); return roles; } else { console.log(“User has no roles”); return ; } } catch (error) { console.error(error); throw error; } } app.use(async (req, res, next) =\> { try { const userId = req.oidc.user.sub; const roles = await getUserRolesFromAuth0(userId); res.locals.roles = roles; res.render(‘index’, { roles: roles }); next(); } catch (error) { next(error); // Pass any errors to the error-handling middleware } }); I am currently doing it like this but this does not export ‘roles’ to index.ejs hence i’m assuming its the wrong approach Kindly help ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [October 18, 2023, 10:18pm UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/3 "2023-10-18T22:18:58Z")
Hello @nalawalaq welcome to the community! > [@nalawalaq](#): > > i want to perform role based authorization so that only certain users can access the certain functionalities. How do i implement this? The best way to go about this is to implement [Role Based Access Control](https://auth0.com/docs/manage-users/access-control/rbac) (RBAC) - You can have this [enabled](https://auth0.com/docs/get-started/apis/enable-role-based-access-control-for-apis) for your [API you’ve registered in Auth0](https://auth0.com/docs/get-started/auth0-overview/set-up-apis). The flow goes something like this: - User authenticates at your web app and obtains an ID/access token. - The access token is included as an `Authorization` header in requests to the API that you have registered in Auth0. - Your API validates the token and then checks the `permissions` claim, scopes, etc. depending on your specific needs. I recommend taking a look at at the `express-oauth2-jwt-bearer` library referenced in the following guide for validating tokens on your backend/API: > **[Node.js API Authorization By Example](https://developer.auth0.com/resources/guides/api/express/basic-authorization)** > > Learn how to add authorization to Express.js using JavaScript and Node.js middleware. ---
**Author:** ![nalawalaq](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nalawalaq/32/51743_2.png) [@nalawalaq](https://community.auth0.com/u/nalawalaq)\ **Post date:** [October 19, 2023, 7:55am UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/4 "2023-10-19T07:55:44Z")
I’ve gone through the docs and followed the steps mentioned but i’m still not able to solve my issue. I have attached my repo please could you have a look into it? > **[GitHub - Qasim1507/CRUD-Employee-App: Employee Device Database](https://github.com/Qasim1507/CRUD-Employee-App)** > > Employee Device Database. Contribute to Qasim1507/CRUD-Employee-App development by creating an account on GitHub. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [October 24, 2023, 10:58pm UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/5 "2023-10-24T22:58:39Z")
Hey @nalawalaq! What issue are you currently facing? Unfortunately, I’m not able to discern much from looking at your application code. ---
**Author:** ![nalawalaq](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nalawalaq/32/51743_2.png) [@nalawalaq](https://community.auth0.com/u/nalawalaq)\ **Post date:** [October 25, 2023, 10:48am UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/6 "2023-10-25T10:48:19Z")
Basically after the user logs in there is a crud app with edit, delete, view and add record buttons. i want to make it such that the edit, delete and add buttons are only enabled if the user logging in has an admin role. if the user has an employee role i want to disable the edit, delete and add buttons. The auth0 authentication is working without any issues but this authorization that i want to perform is not possible. I’ve tried various methods as well as gone through the auth0 rbac docs but i cannot find a solution for this ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [October 26, 2023, 9:57pm UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/7 "2023-10-26T21:57:44Z")
Thanks for confirming! > [@nalawalaq](#): > > The auth0 authentication is working without any issues but this authorization that i want to perform is not possible. > > I’ve tried various methods as well as gone through the auth0 rbac docs but i cannot find a solution for this Are you able to validate an access token successfully? Once validated, you should be able to make decisions in your API/backend logic based on the `permissions` claim and/or roles if you add them as a custom claim in the access token: [https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506](https://community.auth0.com/t/how-to-add-roles-and-permissions-to-the-id-token-using-actions/84506) ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [November 9, 2023, 9:58pm UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/8 "2023-11-09T21:58:29Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed. ---
**Author:** ![Tiffani](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tiffani/32/75235_2.png) [@Tiffani](https://community.auth0.com/u/Tiffani)\ **Post date:** [July 29, 2026, 4:53pm UTC](https://community.auth0.com/t/web-app-authorization-acc-to-role-assigned/118804/9 "2026-07-29T16:53:17Z")