{"id":70751,"date":"2025-01-28T18:44:35","date_gmt":"2025-01-28T13:14:35","guid":{"rendered":"https:\/\/www.guvi.in\/blog\/?p=70751"},"modified":"2025-04-17T10:48:42","modified_gmt":"2025-04-17T05:18:42","slug":"protecting-routes-with-jwt-middleware-in-node-js","status":"publish","type":"post","link":"https:\/\/www.guvi.in\/blog\/protecting-routes-with-jwt-middleware-in-node-js\/","title":{"rendered":"Protecting Routes with JWT Middleware in Node.js"},"content":{"rendered":"\n

In modern web development, ensuring the security of application routes is paramount, especially when dealing with sensitive user data and resources. JSON Web Tokens (JWT) have emerged as a reliable solution for handling authentication and safeguarding access to protected endpoints. <\/p>\n\n\n\n

This blog walks you through creating a reusable JWT middleware in Node.js that verifies JWTs efficiently, centralizes authentication logic, and enhances the security and scalability of your application.<\/p>\n\n\n\n

Setting Up Authentication Middleware<\/strong><\/h2>\n\n\n\n

Middleware in Express.js enables you to add functionality to your route handlers. In our case, we\u2019ll use middleware to verify if the incoming request contains a valid JWT.<\/a> Here\u2019s how to create an authenticateToken middleware that checks for a JWT token in the Authorization header:<\/p>\n\n\n\n

const jwt = require('jsonwebtoken');\nconst SECRET_KEY = 'your_secret_key'; \/\/ Store this in an environment variable for security\n\n\nfunction authenticateToken(req, res, next) {\n  const token = req.headers['authorization']?.split(' ')[1]; \/\/ Extract the token from the Authorization header\n\n\n  if (!token) return res.status(403).send('A token is required for authentication'); \/\/ Return error if no token\n\n\n  jwt.verify(token, SECRET_KEY, (err, user) => {\n    if (err) return res.status(403).send('Invalid Token'); \/\/ Return error if token is invalid\n\n\n    req.user = user; \/\/ Attach user data to request object for use in route handlers\n    next(); \/\/ Pass control to the next middleware or route handler\n  });\n}\n<\/code><\/pre>\n\n\n\n
Also Read: Cross-Origin Resource Sharing (CORS) in detail<\/a><\/strong><\/p>\n\n\n\n
This middleware function performs a few key tasks:<\/p>\n\n\n\n
    \n
  1. It extracts the JWT from the request\u2019s Authorization header.<\/li>\n\n\n\n
  2. If the token is missing, it returns a 403 Forbidden response.<\/li>\n\n\n\n
  3. It verifies the token using a secret key.<\/li>\n\n\n\n
  4. If the token is valid, it attaches the user data to the request object, allowing the user data to be accessible in subsequent route handlers.<\/li>\n\n\n\n
  5. Finally, it calls next() to pass control to the next middleware or route handler.<\/li>\n<\/ol>\n\n\n\n
    With this middleware in place, any route it is applied will require a valid JWT for access.<\/p>\n\n\n\n
    Applying Middleware to Protect Routes<\/strong><\/h2>\n\n\n\n
    Once the authentication middleware is set up, you can apply it to specific routes you want to protect. Let\u2019s add this middleware to a protected \/dashboard route so that only users with a valid token can access it:<\/p>\n\n\n\n
    app.get('\/dashboard', authenticateToken, (req, res) => {\n  res.send(`Welcome ${req.user.username}, to your dashboard!`);\n});\n<\/code><\/pre>\n\n\n\n
    In this example:<\/p>\n\n\n\n