Myujth

Before I have to say that I've found some post related this question but not fully answered.

So I implement a nodejs REST API server, DB with mongoDB, however about authentication i understand the idea, with jwt token it work perfect.

/api/login

you get response with token. now you can request resource with this token
for example.

api/posts/:user_id

get all your posts...No problem! query with mongoose findBy.. bla bla!

so for authorization in this case it's easy, check for query param user_id is equal to token (token parse with user_id). boom resources is secure.

but in case that I have some resources they're not reference by user_id, What is best practice to protect this resources?!

example

api/settings/:settings_id/emails

imagine that I know the setting_id of other user, and i authenticated with token. so how server will know this resources is not allowed for me?

First, you should do more to protect the token in the first place. When you issue a token after a user logs in you should store their token on either web storage like sessionStrorage if https is enforced or use an httpOnly cookie (You can add a user-agent/geoip fingerprint in addition to the user_id upon signing this token to add an additional layer of security). Then, when a user makes a request for a protected resource, you can match the fingerprint and user_id you signed the token with to the user they are making the request in behalf of.

You could use something like passport-jwt as a middleware in express to require authentication on routes. In passport, you define an extractor handler that basically tells it where to look to see if the user has a token and if they do and it validates it adds the req.user property that you can use on subsequent requests to determine the user_id of the token bearer. So basically with this approach, you know the user_id on every request which lets you compare that with the user information they are requesting.

app.post('/settings/:settings_id/emails', passport.authenticate('jwt', session: false ),
 function(req, res) 
 res.send(req.user.id);
 
);

Instead of keeping track of the user_id in javascript in the browser, save it to a cookie upon login. Using express.js that would be

app.post('/api/login', function(req, res) 
 var user_id = "someid-1354654";
 res.cookie("user_id", user_id);
 res.send("hello there. I've just set a cookie.");
);

When a new request comes in, check if the cookie is (still) there:

app.get('/api/settings/:settings_id/emails', function(req, res) 
 if(req.cookies.user_id == "someid-1354654")
 res.send("congrats, your user_id is still known to me: " + req.cookies.user_id);
 else
 res.send("you don't have access.");
);

It would be better to use some module like Passport, but this way you'll get the basics of authentication and cookies.