I'm currently building a Node/Express app using Passport for user authentication and Sequelize for database queries. It's a 'To-do list' app which currently has 3 models: User, List and Task. My back-end database calls are done using an API. My front-end uses AJAX to retrieve the data.

This is my first time using Passport for authentication, so I was wondering if there are any security problems in my current code. I am specifically concerned about Users being able to retrieve info about other Users by modifying the requests to my API.

Here is an example of an API call to create a List:

// Create list
router.post('/lists', isLoggedIn, (req, res) => {
    models.List.build( { name: req.body.name, userId: req.user.id } ).save()
    .then(list => {
    .catch(err => {

// ... other API calls

function isLoggedIn(req, res, next) {    
    if (req.isAuthenticated())
        return next();

And the front-end function that calls it:

// Create list and open it
function addList(name) {
    if (!name.length) return;
           type: "POST",
           url: '/api/lists',
           data: { name: name },
           success: function(data)
               window.location = "/lists/"+data.id;

I am 99% sure that this is a secure implementation, since it seems like any data sent in the POST request is contained within req.body, whereas req.user is generated by Express/Passport on the server side. However there is still the 1% of me that thinks it might be possible to modify req.user in the POST request and be able to get information about other Users.

Are my worries for nothing, or is there a better way to implement this?

  • \$\begingroup\$ What strategies (if any) are you using within passport? Without seeing more of how the server is setup it'd be hard to say, but I'd start with using Passport Bearer tokens (which I assume you're not as you're not sending headers in your AJAX call) and oAuth as an extension is pretty easy to implement for a decent security base for your API. \$\endgroup\$
    – AE Grey
    Commented Apr 11, 2018 at 8:23

1 Answer 1


Given req.user is set at the server then, unless your server is compromised, you can ignore the 1%.

Relying on server-side user data is the correct approach - never trust the client.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.