How to protect routes in express.js?

Question

For example, in Meteor, there's something like

Router.plugin('ensureSignedIn');
Router.plugin('ensureSignedIn', {
  except: ['home', 'atSignIn', 'atSignUp', 'atForgotPassword']
});

So unsigned user cannot access other routes except above four.

How to do this in express.js? I'm using passport.js also.

Solution

I'm not familiar with Meteor, but you can do something like the following, assuming you want to make pages available to only authenticated users (passport).

function ensureAuthenticated(req, res, next) {
  if (req.isAuthenticated())
    return next();
  else
    // Return error content: res.jsonp(...) or redirect: res.redirect('/login')
}

app.get('/account', ensureAuthenticated, function(req, res) {
  // Do something with user via req.user
});

The ensureAuthenticated function is just an example, you can define your own function. Calling next() continues the request chain.