All 15 Authentication & Authorization questions
More in Authentication & Authorization
What is the difference between storing an authentication token in localStorage versus an httpOnly cookie, from a security perspective? How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? What is a JSON Web Token (JWT), and what are its three parts? What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods? What is CSRF (Cross-Site Request Forgery), and how do you protect a Node.js session-based application against it? How do you implement email verification and password-reset flows securely in a Node.js application? How would you implement Attribute-Based Access Control (ABAC) in a Node.js application when RBAC roles aren't expressive enough? How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token? How does the OAuth 2.0 Authorization Code flow work, and what role does Node.js typically play as the client or the resource server? What is Multi-Factor Authentication (MFA), and how would you implement Time-based One-Time Password (TOTP) support in a Node.js app?
Advertisement
Back to results for “RBAC”
Node.js › Authentication & Authorization

What is Role-Based Access Control (RBAC), and how would you implement it as Express middleware?

Intermediate

Answer

RBAC assigns each user one or more roles (like 'admin', 'editor', 'viewer'), and access to specific resources or actions is granted based on the role rather than checking individual permissions per user -- this simplifies permission management considerably when many users share the same access needs, since granting or revoking access to a whole category of actions is done once at the role level rather than per user.
function requireRole(...allowedRoles) {
  return (req, res, next) => {
    if (!allowedRoles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
}

app.delete('/users/:id', requireAuth, requireRole('admin'), deleteUserHandler);
app.put('/posts/:id', requireAuth, requireRole('admin', 'editor'), updatePostHandler);
Real-world example A content-management API restricts the DELETE /users/:id endpoint to only the 'admin' role while allowing both 'admin' and 'editor' roles to update posts, implemented as a single reusable requireRole() middleware parameterized differently per route rather than duplicating permission-check logic in each handler.

Common follow-ups: How does RBAC compare to a more granular permission-based (or ABAC, Attribute-Based Access Control) system when roles alone aren't expressive enough?;How would you handle a user who needs temporary elevated access for a specific task?

Express & Middleware;Security
All 15 Authentication & Authorization questions