Inquiry: Using `jwtAuthz` in a Route Handler function about express-jwt-authz

[adamjmcgrath]

Hi @aMahanna, thanks for raising this.

Your example is nearly right, you just need to execute the middleware with the request context jwtAuthz((...])(req, res, next).

However, I don't think this is a good idea, mainly from a security point of view. For example if multiple scopes are provided, the user only needs one of the specified scopes to access to route. If I had scope a and not b - I might be able to trick your route handler into giving me access to a by providing both a and b eg. /a%20b. I know in your current configuration this wouldn't be possible, but you can imagine some fairly innocent changes to the SDK or your code that might trigger a vulnerability.

It's always better to rely on server configuration rather than user input to configure security features on your server.

There's also usually a performance penalty to initialising a new instance of middleware on every request, since lots of middleware will likely cache work in memory to use across requests.

If you want to shorten your code you could maybe try something like:

for (const route of ['a', 'b', 'c']):
  app.get('/' + route,
   jwtAuthz(['read:' + route]),
   ...
);

[aMahanna]

@adamjmcgrath thank you! and no worries on the delay

[adamjmcgrath]

(also apologies for the long delay in replying)