---
title: "Implement an Express.js authentication middleware to protect routes from unauthorized access."  
description: "Implement an Express.js authentication middleware to protect routes from unauthorized access."  
author: "Steilla Mitchel"  
published: 2023-07-26  
updated: 2023-07-27  
canonical: https://www.mindstick.com/forum/159306/implement-an-express-js-authentication-middleware-to-protect-routes-from-unauthorized-access  
category: "javascript"  
tags: ["javascript", "express js", "mern"]  
reading_time: 2 minutes  

---

# Implement an Express.js authentication middleware to protect routes from unauthorized access.

Implement an Express.js [authentication middleware](https://www.mindstick.com/forum/160306/explain-the-role-of-authentication-middleware-in-dot-net-core-api) to [protect](https://www.mindstick.com/interview/479/how-to-protect-special-characters-in-query-string) routes from [unauthorized access](https://www.mindstick.com/forum/158562/how-can-wireless-networks-be-secured-against-unauthorized-access-and-attacks).

## Replies

### Reply by Aryan Kumar

Sure, here is an example of how you can implement an Express.js [authentication](https://www.mindstick.com/blog/177/authentication-and-authorization-in-asp-dot-net) [middleware](https://www.mindstick.com/forum/159733/what-is-the-role-of-middleware-in-dot-net-core-web-api) to protect routes from unauthorized access:

JavaScript

```plaintext
const express = require('express');
const jwt = require('jsonwebtoken');

const authMiddleware = (req, res, next) => {
  const token = req.headers['authorization'];
  if (!token) {
    return res.status(401).send('Unauthorized');
  }

  try {
    const decodedToken = jwt.decode(token, process.env.JWT_SECRET);
    req.user = decodedToken.user;
  } catch (error) {
    return res.status(401).send('Unauthorized');
  }

  next();
};

module.exports = authMiddleware;
```

This middleware first checks the `authorization` header in the request. If the header is not present, the middleware returns a `401 Unauthorized` response.

If the header is present, the middleware extracts the token from the header and decodes it using the `jwt` library. The `decode()` method returns an object containing the decoded token, including the user's ID.

The middleware then stores the user's ID in the `req.user` property. This property can then be accessed by other middleware or routes to check if the user is authorized to access the resource.

Finally, the middleware calls the `next()` function to continue the request processing.

To use this middleware, you would need to add it to your Express application. For example, you could add it to the `app.use()` method:

```plaintext
app.use(authMiddleware);
```

This would add the middleware to all routes in the application. You could also add the middleware to specific routes by using the `app.route()` method:

```plaintext
app.route('/protected').use(authMiddleware);
```

This would add the middleware to the `/protected` route only.


---

Original Source: https://www.mindstick.com/forum/159306/implement-an-express-js-authentication-middleware-to-protect-routes-from-unauthorized-access

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.