Back

Protected routes

A protected route only works for logged-in users. Use middleware that verifies the token first: valid means continue, missing or invalid means return 401.

function requireAuth(req, res, next) {
  const token = req.headers.authorization?.split(" ")[1]
  if (!token) return res.status(401).json({ error: "No token" })

  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET)
    next()
  } catch {
    res.status(401).json({ error: "Invalid token" })
  }
}

app.get("/api/profile", requireAuth, (req, res) => {
  res.json({ userId: req.user.id })
})

Roadmap