Node.js + Express.js User Permission Security Model

Solution 1:

Having it per-route usually works for me. This is what I typically do:

function requireRole (role) {
    return function (req, res, next) {
        if (req.session.user && req.session.user.role === role) {
            next();
        } else {
            res.send(403);
        }
    }
}

app.get("/foo", foo.index);
app.get("/foo/:id", requireRole("user"), foo.show);
app.post("/foo", requireRole("admin"), foo.create);

// All bars are protected
app.all("/foo/bar", requireRole("admin"));

// All paths starting with "/foo/bar/" are protected
app.all("/foo/bar/*", requireRole("user"));

Solution 2:

You can use ability-js with everyauth, which is quite similar to CanCan for Rails https://github.com/scottkf/ability-js

Solution 3:

Take a look at this list for NodeJS ACL/Permission systems. IMHO OptimalBits node_acl looks best.