Mastering Node.js Web Development

15

Authenticating and Authorizing Requests

Most projects need to restrict access to features; otherwise, anyone who knows an application’s URL can execute any operation. This is currently how the example application is set up: anyone who can request http://localhost:5000 will be able to store and delete data, regardless of who they are.

Authorization, often referred to as AuthZ, is the process of restricting access so that operations can only be performed by some users – known, naturally enough, as authorized users. Authentication, often referred to as AuthN, is the process of a user identifying themselves so that the application can determine whether the user is authorized for the operations they request. This chapter explains how Node.js applications ...