Search code examples
authenticationjwtloopbackjsmiddleware

How To Deny Access In Loopback's 'AUTH' Middleware

We're using Loopback for our REST endpoints and want to authenticate using Loopback's 'auth' middleware. We have the authentication event code working, but what's the code that actually denies access?

app.middleware('auth:before', auth)

function auth(req, res) {
    // HOW TO DENY ACCESS HERE?
 }

NOTE: We're using our own user model, not Loopback's.

Solution

  • You would handle this like you would any other authentication check. So if your logic is, "if some session variable isn't defined, go to a login route, otherwise carry on", then your logic would be simply that. Check for the session var, redirect on it not existing, and if everything is ok, just next(). (You want to add next as a third argument to your middleware function.)