Authentication middleware in Express NodeJS - Best practice

Question

I'm writing my first Express NodeJS app and I want to know what is the best practice when it comes to authentication middlewares?

I'm using access tokens and cookies (which are composed from user id and some random bytes) for each new user, and for some routes I want only given users to have access to it.

Is a good idea to access database from a middleware? Or where should I check if a given user has access to a given resource?

Thank you!

Answer 1

There are many modules built for authentication purpose for nodejs applications. However, the most commonly used module for nodejs/expressjs is Passport.
If you wish to stay isolated from such libraries, nodejs has built-in libraries for encryption etc, for example, check this out.
For sessions and cookies, using signed cookies is always a good practice. Check out this SO post. There are many good practices for maintaining security (say, using https over http, token based authentication, etc.) followed throughout the development grounds, which you'll learn as you go on. Here is a short tutorial of JWT(JSON Web Tokens) for a good introduction to token based authentication in JSON you can check out.
Happy coding :)