How To Manage User Roles In Node.js

🚨 IMPORTANT:
1 Year Free Hosting: www.atlantic.net/webdevsimpli...
Use code KYLE for an additional $50
User permission systems are the core of nearly every application. From Reddit to accounting every site needs to manage user permissions, but that is much easier said than done. In this video I will be showing you exactly how to set up a flexible and robust user permission system which you can use in any Node.js application.
📚 Materials/References:
Starting GitHub Code: github.com/WebDevSimplified/n...
Ending GitHub Code: github.com/WebDevSimplified/n...
HTTP Status Codes Tutorial: • Learn HTTP Status Code...
🧠 Concepts Covered:
- How to handle user auth in Node.js
- How to create flexible user permissions in Node.js
- How to manage scoped routes in Node.js
🌎 Find Me Here:
My Blog: blog.webdevsimplified.com
My Courses: courses.webdevsimplified.com
Patreon: / webdevsimplified
Twitter: / devsimplified
Discord: / discord
GitHub: github.com/WebDevSimplified
CodePen: codepen.io/WebDevSimplified
#Node.js #WDS #UserPermissions

[@cdporgrammer7168]

Man I wonder if Kyle actually realises how much he helps us out with his vids man
Respect man

[@MrEnsiferum77]

React kids won't understand u...

[@astkh4381]

@@MrEnsiferum77 реакт тут причем?

[@hnasr]

Legend! Love the way you clearly explain these concepts in a simple way. Cheers bro. You are on my recommended channel list on my YT

[@AmanNidhi]

i recommend you both on mine

[@neon13x]

Legend praising another legend

[@kartikjha833]

This comment section is pretty legendary

[@JD-hq1kn]

Ok

[@mrsmasked180]

You're simply the best out there because you explain your content very well and you go straight to the point, respect man you're a legend !

[@eduardonunes1379]

This video is so motivating since I was taking a break from programming bc of authentication and authorization. Thank you so much!

[@ridl27]

such a clear explanation, thank you!

[@taquilol]

pretty much exactly the video I needed for a project. My man web dev simplified is a legend.

[@cdporgrammer7168]

You get it m8

[@sohailkashif6992]

@@cdporgrammer7168 dear how it connect with mongodb?

[@tyrrelldavis9919]

Very true.
He is one of the few "bigger" code UA-camrs that has beneficial stuff I've used in real projects

[@tyrrelldavis9919]

@@sohailkashif6992 a common cope I would get hit with in boot camp was,
"Depends on your use case"
Which it actually does.
Having a hard time understanding the relationship between a user of the database
And
A user that is using the site.

[@ng4logic]

this dude is literally a mentor

[@T3kKeN9]

Awesome video. Concept of modularity with pure functions make this truly scalable.

[@HashimWarren]

Love the progression in this video. Super clear

[@evanmcdaniel5544]

Thanks so much for this. One of the better Node tutorials I've seen.

[@jmmacatangay_grizzlybear]

I always keep telling everyone to subscribe to your channel. you're really great really hoping people would recognize you more often.

[@pavelsokolov4190]

Currently I'm learning MEAN and this is exactly what I need for my pet project. Thank you so much for what you're doing!

[@kmparkhu]

Yay!!!!!!!!!!!!!!!!!!! So awesome!!! Thank you !!!! I was just thinking about this because I been following your other tutorials and I love them. I am excited to watch this video.

[@dthoma128]

Kyle ... great tutorial ... very glad I found your channel! Thank you.

[@pprathameshmore]

Before watching this video, I was creating separate documents for admin and user. Thank you for such a clear explanation tutorial.

[@sandVidz]

I did that and submited lol. Had to pay for that in viva.

[@riadhossain4020]

Kayel your videos are greate for intermediat developers. Clear and simple explanations. Have been following you. You are recommended.

[@bedrockcoder5169]

*Kyle
*great
*intermediate

[@jeffmair]

Your tutorials are top notch Kyle!

[@NorteXGame]

Never happier when any youtuber uploads

[@joel9909]

Just found your channel, loving it so far.

[@stylesoftware]

Awesome, helped me with some of my lingering middleware integration ignorance. Well explained!

[@coanjos]

This video came in the perfect time. Thank you!

[@rfossella]

As usual, great video - clear, concise and immediately usable. Thanks!

[@williamxu2402]

Thank you very much! This is exactly what I needed for my project!

[@apurvsawant5703]

Exactly the video I needed. Thanks man.

[@sapnilpatel1645]

Your video helps me a lot. I really appreciate your effort.
Thank you so much!

[@virgiliogervacioestadillo1389]

Thank you so much Kyle. I found this very helpful.

[@Hrit]

Enjoyed the turotial throughly!

[@feminjustin2478]

you explain things so simply....easy to follow.....

[@a1225johnny]

very clear, it’s helpful in my project. Thanks a lot

[@thejasong01]

YOU ARE AWESOME thankyou for putting great content, with fast but effective and SIMPLE :)

[@adithyasanthosh30]

Nice. Introductory tutorial on how to manage user roles.

[@juliecherner9085]

Thank you for such an amazing tutorial!

[@BBI-Brandboost]

Thanks for sharing, it is nice and easy to follow which is a massive help.

[@yabtsegayeshidnber5226]

This is the best video about role based authentication...Thanks

[@medAmineRg]

that was a great video thankyou so much!

[@danial9864]

Thank you so much for the tutorial video it's quite informative and professional

[@taherr1341]

Awesome. You are the best. I wonder who could be so unfair to dislike it?

[@ginokoybi7010]

Your video help me too much thanks 🙏

[@user-qo3fu1lb2l]

Thank you very much. This video... no, all your videos I watched are amazing and helpfull!

[@LabhamJain]

You've Successfully Simplified Web For Us. Mission Accomplished 😎

[@TheBabelian]

wow! such a great tutorial. thanks for the guide!

[@pankaj_9998]

Thank you. This was a great learing experience.

[@saisaske1]

Just want to say thankyou man. Words are short here.

[@pedro_jaber9357]

OMG! thank you. I believe in Web Dev Simplified supremacy!!!!!

[@vinhubcompters]

best teacher ever

[@omrimaher2754]

Really amazing explanation!

[@mamusthafa6]

YOu are amazing... Really simplified complex things

[@BenOdari]

You have helped me alot In React js

[@swibay]

My name is Kyle and my job is to simplify the web for you!
Your tutorials are always gre8!

[@thinkdomotic4915]

Great content, very helpful, thanks lots

[@nitindaphale2008]

Very good explained , Love from India.

[@thedevlife]

Great content. Gives motivation to keep our channel going.

[@sabuein]

Thank you, Kyle.

[@edisvelicanin8854]

exactly what i was looking for

[@nirmesh44]

Perfect. Very nicely done

[@fullstackgreekdeveloper8033]

Thank you for this video!

[@talha-cs]

Nicely explained

[@geld5220]

too good. I did a version in typescript but followed your flows. Thanks

[@macarenamolina8875]

THANK YOUUUUUUUUUUU!!!!!! I finally understand this.

[@houssemkhi5036]

great as usual

[@HurikaneTv]

Kyle ... One Word: Genius

[@mayank_singh_43]

This is what i want , u are awesome sir 🤘🤘🤘

[@ononaokisama]

Literally god tier content

[@sakshamsrivastava6280]

thanks for this man

[@omar9987]

It would be awesome if you could create like a mini blog[or anything] with react & express that uses user-based roles. I'm trying to add user based rules to my react app :p

[@alex_lomov]

Great layout of material.

[@piyushpatil6874]

Loved it :)

[@amitshrestha898]

Found what I am looking for thanks.

[@nfaical3]

Thank you very much , as always easy explanations.
Please add how to protect the server from attacks like ddos and brute force attack.

[@indigosay]

I was just about to look for this information

[@iurii7752]

The best educational videos

[@ankitdubey9310]

best video, way to go

[@jacob.lee380]

Every time I get stuck in something and try to solve a problem by myself. I'm always ended up on your video finding a solution

[@tough_year]

Awesome video !!!

[@shuvokhan2054]

You're my boss ❤

[@rishabsharma5307]

Awesome video

[@bodolawale5448]

Lovved it thanks

[@sonamuhialdeen7866]

So good tutorial

[@vidumini23]

Very useful. Thank you..

[@tharhtetkyaw7528]

thanks you are a legend

[@agasthya3693]

Hey Kayle please do video on Gulp, Grunt, webpack and parcel & when to choose which tool

[@jodufan8754]

I would recommend to assign every role an int so you can calculate up and downwards !
Edit: To calculate the inheritance of the groups if given!

[@montasirmahmud3585]

Why ? explain briefly please..

[@jodu]

@@montasirmahmud3585 Then you can just use bit calculations to check if a role is hierarchically over another role or not by for example using >=

[@benjamincisneros797]

Great video. I just think one small refactor is to use the canViewProject function inside your filter for scopedProjects

[@harleyspeedthrust4013]

I've got a permission system where the permissions are strings like "mail.create" or "mail.*". Each user has an array of permissions, and the permission strings are referenced in a POJO that maps object keys to permission names. So if you have an endpoint that should be accessible to anyone with a mail permission, you call `hasAnyPermission(req.user, Permissions.mail)` where Permissions.mail is an object containing more fine-grained permissions, and that endpoint would be accessible to anybody with a "mail.(whatever)" permission. "*" is a wildcard that refers to all sub-permissions, so if someone has the permission "*" then they're a superuser, and if they have the permission "boards.*" then they can do anything on any image board. There are some functions, like `hasAnyPermission` or `hasPermission` that you stick at the beginning of your route handler to enforce the permissions.
Of course you don't have to put them at the beginning of your route handler - the entire frontend of the app is handlebars so I also use them on specific pages where I want to display some items/links but each link requires a separate permission. I'm actually pretty surprised that I've made it this far using only handlebars and plain JS for the frontend. The backend is NodeJS with Typescript which is great but I've managed to write a multiplayer FPS almost entirely in plain JS (server-side is that typescript nodejs I just mentioned) and build a forum engine and now I've set up a mail server and a way for users to create and manage email addresses on my domain. handlebars may not be flashy but damn if I like it

[@dpolo567]

Thanks for the great tutorial. In the end, I'm just wondering (if we work with real data obtained from the database), what is the best way to filter the data (in this case the scopedProjects function).
If we have a lot of data, in this case we need to fetch all of them and then filter them. Isn't it better (in terms of performance) to check the role first and then pull only specific (filtered on db query level) data from the database?

[@aamersohail474]

Thanks man

[@prospect8843]

You always get me bro

[@poojashukla3714]

Big thanks

[@MohammadBarghamadii]

Thank you so much

[@ayoubalem865]

7:11 Th res.Status Should be 401 Not 403
401 Means Unauthorized , Forbidden Mean He is Sign Up But he doesn't have the permission to access to the given operation.
Thank You btw !

[@Study-bt6qh]

kakashi hatake😍😍

[@FSaidArslan]

Very good ❤

[@indigosay]

I added this video to my Gold Collection

[@dontbetoxic4387]

This is so cool

[@joylearn2868]

Kyle!!!
I want to store a string like '' string'' in a variable, which each character store in a variable or array, which come from an input

[@ayushthakur733]

So accurate with the name web dev SIMPLIFIED

[@tranquility6358]

I believe you mixed up the status codes a bit.
401 Unauthorized - send this code when the user is not authorized to view the content (as in the user didn't login)
403 Forbidden - send this code when the user is logged in, but is not allowed to view specific content
The difference between these status codes is that 401 should be sent if authorization fails, but proper authorization is possible while 403 is sent when the user is authorized, but doesn't have the required permissions.

[@ArthurCowdery]

are you sure?
authentication means verifying identity. It gets confusing because the header used to authenticate is called 'authorization' but it is still authentication and 401.
authorization means verifying permissions which is 403

[@brielov]

I agree... 401 is for unauthorized (not logged in) and 403 is forbidden (resource authorization)

[@Hadermite]

@@ArthurCowdery Yes, he's correct. The title of the status code is a bit messed up, should probably have been "Unauthenticated" instead, it generates a lot of confusion.

[@andrejvujic]

@Jovan Jevtic jovaneeeee

[@h4kster182]

Nice explanation

[@syedovaiss]

Hi. Can you give me an idea how to apply this logic
User submitted a form if admin approved that user's form it will be shown otherwise not

[@maplestoryinchinese]

More tutorials please!

[@yadneshkhode3091]

Thank you !!!

[@webmobi2773]

Thank you ❤️