'Better approach for User auth in Restful API
I am writing my first app in NodeJs (using express, mongoDB and mongoose) and I am not sure which approach I should use for auth and data filtering while calling a get method.
The app is a small office management system. A user can be listed in more than one office. On side menu he can choose one of the offices he listed to, and use the different features of the app.
lets say we have a simple task feature in the app, and I want the user to retrieve the tasks relevant to the office he picked from the menu (and not all tasks of all offices he listed to).
Which approach is the better one:
On the
User_Schemahave an attribute ofcurrent_office, then when user picks office from menu, updating in database the current office, and when client callsget('/tasks', authMiddleware, async (req, res) =>{...}take the current office from thereq.usercame back from auth middleware and retrieve the relevant tasks.Have the current office encoded in the JWT token created, and generating a new token for user each time he choose a different office in the app. This way when calling
GET methodlike in the section above (1), get the current office from the token decoding and authMiddleware.Not holding any current office in Schema, and make get method to look something like
get('/tasks/:officeID', authMiddleware, async (req, res) =>{...}meaning Front-end will be responsible for sending the officeID in request parameters (officeID that the user is currently using in the app).
If you have any other approach that is not listed above and I didn't thought of, I`ll be glad to hear (its really my very first app in NodeJs).
Thank you very much in advance!
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
