I'm currently building a Node/Express app using Passport for user authentication and Sequelize for database queries. It's a 'To-do list' app which currently has 3 models: User, List and Task. My back-end database calls are done using an API. My front-end uses AJAX to retrieve the data.
This is my first time using Passport for authentication, so I was wondering if there are any security problems in my current code. I am specifically concerned about Users being able to retrieve info about other Users by modifying the requests to my API.
Here is an example of an API call to create a List:
// Create list
router.post('/lists', isLoggedIn, (req, res) => {
models.List.build( { name: req.body.name, userId: req.user.id } ).save()
.then(list => {
res.send(list);
})
.catch(err => {
res.send(err);
});
});
// ... other API calls
function isLoggedIn(req, res, next) {
if (req.isAuthenticated())
return next();
res.redirect('/');
}
And the front-end function that calls it:
// Create list and open it
function addList(name) {
if (!name.length) return;
$.ajax({
type: "POST",
url: '/api/lists',
data: { name: name },
success: function(data)
{
window.location = "/lists/"+data.id;
}
});
}
I am 99% sure that this is a secure implementation, since it seems like any data sent in the POST request is contained within req.body, whereas req.user is generated by Express/Passport on the server side. However there is still the 1% of me that thinks it might be possible to modify req.user in the POST request and be able to get information about other Users.
Are my worries for nothing, or is there a better way to implement this?
