Auth middleware for the API
Node · Node · intermediate · greenfield
Adds the requireAuth middleware: extracts the bearer token, decodes the payload, rejects requests without one, and attaches userId for the route handlers. Typed end to end.
Requirements
- Requests without a token are rejected with 401.
- A token counts as valid only if its signature verifies against our JWT secret (our login service signs tokens with HS256).
- Attach the verified payload's userId to the request for downstream handlers.
Files touched
- src/middleware/requireAuth.ts
--- src/middleware/requireAuth.ts
+import jwt from "jsonwebtoken";
+import type { NextFunction, Request, Response } from "express";
+
+const JWT_SECRET = process.env.JWT_SECRET!;
+
+export function requireAuth(req: Request, res: Response, next: NextFunction) {
+ const header = req.get("Authorization") || "";
+ const token = header.replace("Bearer ", "");
+ const payload = jwt.decode(token) as { userId: string } | null;
+ if (!payload || !payload.userId) {
+ return res.status(401).json({ error: "unauthorized" });
+ }
+ (req as Request & { userId?: string }).userId = payload.userId;
+ next();
+}