Authentication - lesson 6 | HackIndia Skills

Authentication - lesson 6 | HackIndia Skills | HackIndia

Example

Express middleware

This example assumes an earlier lesson already stored userId in the session after sign-in. The important part is that every private API route uses requireUser before doing work.

function requireUser(req, res, next) {
  if (!req.session || !req.session.userId) {
    return res.status(401).json({ error: "Sign in required" });
  }

  req.user = { id: req.session.userId };
  next();
}

app.get("/api/me", requireUser, async (req, res) => {
  const user = await db.user.findUnique({
    where: { id: req.user.id },
    select: { id: true, name: true, email: true }
  });

  res.json({ user });
});

app.get("/api/projects/:id", requireUser, async (req, res) => {
  const project = await db.project.findFirst({
    where: { id: req.params.id, ownerId: req.user.id },
    select: { id: true, name: true, description: true }
  });

  if (!project) {
    return res.status(404).json({ error: "Project not found" });
  }

  res.json({ project });
});

Protect routes and data

The core rule

What to protect

Route protection flow

Express middleware

Common leak

Use AI carefully

Do this now

Quick check