Securing a specific route node.js

Question

Hey I'm using basic auth for Node.JS to secure a route. I'm pretty new to Node.JS and don't understand what the next function does in this case. What I'm trying to do is to secure a the route: /admin/

Note: This is a project for learning purposes so the login part is not too serious and won't be used live.

authentication.js

var basicAuth = require('basic-auth');

exports.BasicAuthentication = function(request, response, next) {

    function unauthorized(response) {
        response.set('WWW-Authenticate', 'Basic realm=Authorization Required');
        return response.send(401);
    };

    var user = basicAuth(request);

    if (!user || !user.name || !user.pass) {
        return unauthorized(response);
    };

    if (user.name === 'name' && user.pass === 'pass') {
        return next();
    } else {
        return unauthorized(response);
    };

};

and app.js where I imported the module authentication:

app.get('/admin/', authentication.BasicAuthentication, function(req, res){
    console.log("hi u need to login");
});

So what I want to do is to route the user further if the authentication goes through.

Thanks in advance!

Answer 1

Try:

app.get('/admin/', authentication.BasicAuthentication);
app.get('/admin/', function(req, res) {});

Answer 2

This function is known as a middleware:

var basicAuth = require('basic-auth');

exports.BasicAuthentication = function(request, response, next) {

    function unauthorized(response) {
        response.set('WWW-Authenticate', 'Basic realm=Authorization Required');
        return response.send(401);
    };

    var user = basicAuth(request);

    if (!user || !user.name || !user.pass) {
        return unauthorized(response);
    };

    if (user.name === 'name' && user.pass === 'pass') {
        return next();
    } else {
        return unauthorized(response);
    };

};

middleware is a function that you can define for various purposes:

1. using middleware
2. writing a middleware

In a simple way is a function that runs before performing another action, one general purpose is to protect certain routes for unauthorized access.

You can protect private routes calling then authentication.BasicAuthentication before function(req, res) {}

Some example:

app.get('/user-profile/', authentication.BasicAuthentication, function(req, res){
    //private info
});

app.get('/foo/', function(req, res){
    //public info
});