supermamon / node-restify-jwt-sample Goto Github PK

how to create request with different methods or request with id to one path?

In case the user sends its password during registration, the register example just adds the password to the base64 token.
I know this is just an example and you don't pretend to provide an introduction to good security practices, but considering that a lot of newbies will just copypasta your code, this point should be at least explained.

const token = jwt.sign(req.body, config.JWT_SECRET)

should become something like :

// Only put the username in the token, please read about JWT
let user = {name: req.body.name}
const token = jwt.sign(user, config.JWT_SECRET)

see frbuceta/restify-jwt-community#306

I registered an user with somerandomrole.

/api/home works as expected.

However, it's allowed to access the admin-protected route /api/admin.

The expected result would be {"code":"Forbidden","message":"You don't have sufficient priviledges."}.

I created a user with Postman and role : test .

Then I made a request with curl:

It works as expected: access denied.

Then I made exactly the same request again, with exactly the same token, but with Postman:

It bypasses protection and now I can access the admin-protected route with a test role.