Rutas protegidas y middleware
Aprenda a proteger los endpoints de la API mediante middleware que valide los JWT y restrinja el acceso a usuarios autenticados.
Rutas protegidas y middleware es una lección gratuita de AI Powered SaaS: Stripe + Auth + Billing + Deploy en CoddyKit. Esta es la lección 3 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de AI Powered SaaS: Stripe + Auth + Billing + Deploy, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de AI Powered SaaS: Stripe + Auth + Billing + Deploy incluye 4 lecciones en total.
Partes de esta lección aún no han sido traducidas y se muestran en inglés.
Securing Your Digital Doors
Imagine a VIP lounge. Not everyone can just walk in, right? Some areas of your application, like a user's profile or settings, are just like that VIP lounge. They contain sensitive data or allow critical actions.
These are called protected routes. They ensure that only authenticated and authorized users can access specific resources or perform certain operations. Without them, anyone could potentially view or alter sensitive user data.
Your API's Security Guard: Middleware
How do we protect these routes? That's where middleware comes in!
Middleware functions are like security guards that stand between a client's request and your server's route handler. They can inspect, modify, or even terminate requests before they reach their final destination.
Think of it as a checkpoint. Every request must pass through, and the middleware decides if it's allowed to proceed.
The Middleware Flow
Middleware fits right into the request-response cycle. When a request hits your server, it first goes through any configured middleware functions, one by one.
- Intercept: Middleware intercepts the incoming request.
- Process: It performs its logic (e.g., logging, authentication, data parsing).
- Pass On: If all checks pass, it uses a special function (often called
next()) to pass control to the next middleware or the final route handler. - Block: If a check fails (e.g., unauthorized), it can send a response directly and stop the request from going further.
First Middleware Steps
Let's see a basic example. Here's a simple Node.js Express middleware that logs requests. Notice the next() function – it's crucial for passing control.
Try running this example and see the console output!
const express = require('express');
const app = express();
// Define our simple logging middleware
function requestLogger(req, res, next) {
console.log(`[${new Date().toISOString()}] ${req.method} ${req.url}`);
next(); // Crucial: pass control to the next handler
}
// Apply the middleware to all incoming requests
app.use(requestLogger);
// Define a simple route
app.get('/', (req, res) => {
res.send('Hello from the server!');
});
const PORT = 3000;
app.listen(PORT, () => console.log(`Server running on port ${PORT}`));Locating the Authentication Token
For authentication, our middleware needs to find the JSON Web Token (JWT) sent by the client. JWTs are typically sent in the Authorization header of an HTTP request, using the Bearer scheme.
It looks like this: Authorization: Bearer YOUR_JWT_TOKEN_HERE
Our middleware's first job is to extract this token from the request headers.
Checking the Token's Authenticity
Once we have the token, we need to verify it. This involves checking its signature using the secret key that was used to sign it. If the token's signature is valid, we know it hasn't been tampered with.
Here's how you might verify a token using a common library (like jsonwebtoken in Node.js). For this example, we'll simulate a valid token.
const jwt = require('jsonwebtoken'); // npm install jsonwebtoken
const SECRET_KEY = 'my_super_secret_key'; // Keep this secure in real apps!
const mockPayload = { id: 'user123', username: 'alice' };
// 1. Create a mock token (what a login endpoint would generate)
const mockToken = jwt.sign(mockPayload, SECRET_KEY, { expiresIn: '1h' });
console.log('Generated Token:', mockToken);
// 2. Verify the token in our middleware
jwt.verify(mockToken, SECRET_KEY, (err, user) => {
if (err) {
console.log('Token verification failed:', err.message);
} else {
console.log('Token is valid! User:', user);
// In a real middleware, you'd attach 'user' to req object
}
});
Denying Access
What if the token is missing or invalid? Our middleware must respond with an error and prevent the request from reaching the protected route.
- Missing Token: If no
Authorizationheader or token is found, return a401 Unauthorizedstatus. - Invalid Token: If the token exists but is malformed, expired, or has an invalid signature, return a
403 Forbiddenstatus.
This is crucial for security!
Making User Info Available
If the JWT is successfully verified, it contains a payload with user information (like user ID, username, etc.). Our middleware can extract this data and attach it to the request object.
This means that any subsequent route handler for a protected route will have direct access to the authenticated user's details without needing to re-parse the token.
Example: req.user = decodedPayload;
Full Authentication Middleware
Here's a complete Node.js Express setup with our authentication middleware. Notice how authenticateToken is applied to the /profile route, making it protected.
Run this. Try accessing /profile without a token, then with a valid token (from Scene 6).
const express = require('express');
const jwt = require('jsonwebtoken'); // npm install jsonwebtoken
const app = express();
const SECRET_KEY = 'my_super_secret_key'; // Use env vars in production!
// Middleware to authenticate JWT
function authenticateToken(req, res, next) {
const authHeader = req.headers['authorization'];
const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
if (token == null) {
return res.status(401).send('Access Denied: No token provided');
}
jwt.verify(token, SECRET_KEY, (err, user) => {
if (err) {
return res.status(403).send('Access Denied: Invalid token');
}
req.user = user; // Attach user payload to request
next(); // Pass to the next handler/route
});
}
// An unprotected public route
app.get('/public', (req, res) => {
res.send('This is a public route. No authentication needed.');
});
// A protected route
app.get('/profile', authenticateToken, (req, res) => {
res.json({
message: `Welcome to your profile, ${req.user.username}!`,
userId: req.user.id
});
});
const PORT = 3000;
app.listen(PORT, () => console.log(`Server running on port ${PORT}`));Middleware Checkpoint
Consider an authentication middleware designed to protect a route. What is the primary purpose of calling next() within the middleware function?
Lesson Summary: Secure Routes
Great job! In this lesson, you've learned to secure your API endpoints with protected routes.
- We explored how middleware acts as an intermediary, inspecting requests before they reach sensitive parts of your application.
- You saw how to implement an authentication middleware to extract and validate JWTs from incoming requests.
- We covered handling missing or invalid tokens by sending appropriate error responses (
401,403). - Finally, you learned how to attach authenticated user data to the request object and apply this middleware to specific routes, ensuring only authorized users can access them.
Your API is now much more secure!
Aprende AI Powered SaaS: Stripe + Auth + Billing + Deploy con un tutor de IA — gratis
Escribe y ejecuta código real en tu navegador, obtén ayuda instantánea de un tutor de IA disponible 24/7 y continúa donde lo dejaste en la web o en la aplicación.
- Cursos
- 12
- Lecciones
- 48
Preguntas frecuentes
¿La lección «Rutas protegidas y middleware» es gratis?
Sí — el texto completo de «Rutas protegidas y middleware» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de AI Powered SaaS: Stripe + Auth + Billing + Deploy, actualiza a CoddyKit PRO. El curso de AI Powered SaaS: Stripe + Auth + Billing + Deploy incluye 4 lecciones en total.
¿Qué aprenderé en «Rutas protegidas y middleware»?
Aprenda a proteger los endpoints de la API mediante middleware que valide los JWT y restrinja el acceso a usuarios autenticados. Practicas AI Powered SaaS: Stripe + Auth + Billing + Deploy con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.
¿Necesito experiencia previa para empezar AI Powered SaaS: Stripe + Auth + Billing + Deploy?
No se requiere experiencia previa. AI Powered SaaS: Stripe + Auth + Billing + Deploy en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 3 de 4.
¿Cuánto tiempo toma la lección «Rutas protegidas y middleware»?
La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.
¿Puedo escribir y ejecutar código en esta lección de AI Powered SaaS: Stripe + Auth + Billing + Deploy?
Sí. Cada lección de AI Powered SaaS: Stripe + Auth + Billing + Deploy incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.
Todas las lecciones de este curso
- Registro de usuarios y hashing
- Inicio de sesión y generación de JWT
- Rutas protegidas y middleware
- Restablecimiento de contraseñas y verificación de correo electrónico