如果当前用户的 id 与所述路由中的 id 匹配，如何仅允许访问该路由？ 节点

Question

I have a route similar to this:

router.get("/users/:id/thing", middlewareObj.isLoggedIn, function(req, res){
    res.render("thing.ejs");
});

I want this route to only be accessible if the current user's id matches the ":id" in the route. How would I go about doing this? Much appreciated.

Answer 1

You can compare the logged user (I am assuming you have it in req.user [indeed you should check on passport]) with the param ID:

if(req.user.id != req.params.id) return res.status(400);

You could remove the id from the URL and simply use the logged user data. Because if the url id matches the user id, you have something redundant. So, with this..

router.get("/users/thing", middlewareObj.isLoggedIn, function(req, res){
  let id = req.user.id;

  //do something with the ID which you assume you do, otherwise why you want the ID in the first place

  ...

  //return the view  
  res.render("thing.ejs");
});