{"id":2348,"date":"2022-11-08T11:16:48","date_gmt":"2022-11-08T11:16:48","guid":{"rendered":"https:\/\/infyblog.zluck.in\/?p=2348"},"modified":"2025-07-17T09:39:47","modified_gmt":"2025-07-17T09:39:47","slug":"best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization","status":"publish","type":"post","link":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/","title":{"rendered":"Secure NodeJS APIs Using JWT &#038; Custom Auth"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2348\" class=\"elementor elementor-2348\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-82f02be elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"82f02be\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1d24b1c\" data-id=\"1d24b1c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\n\t\t<div class=\"elementor-element elementor-element-5cdf99a elementor-widget elementor-widget-text-editor\" data-id=\"5cdf99a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h2>Overview<\/h2><p>A Node.js library for use as Express middleware to secure endpoints with JWTs. The implementation uses a JWT endpoint of an Authorization Server to get the keys required for verification of the token signature. There is also an example Express app that shows how to use the library.<\/p><p>Package: <span style=\"color: #e83e8c;\">https:\/\/www.npmjs.com\/package\/jsonwebtoken<\/span><\/p><p>Using the JSON web token, we can simply authenticate each and every request on our server. As a standard \/ best practice, we can use JWT (JSON web token) middleware to validate all requests.<\/p><h2>JWT Middleware<\/h2>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6fb6c14 elementor-widget elementor-widget-code-highlight\" data-id=\"6fb6c14\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript \">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp> const jwt = require('jsonwebtoken')\r\n\r\n  module.exports = (expectedRole) => (req, res, next) => {\r\n\r\n  const authHeader = req.get('Authorization')\r\n  if (!authHeader) {\r\n    const error = new Error('Not authenticated.')\r\n    error.statusCode = 401\r\n    throw error\r\n  }\r\n\r\n  const token = authHeader.split(' ')[1]\r\n  if (!token) {\r\n    const error = new Error('Not authenticated.')\r\n    error.statusCode = 401\r\n    throw error\r\n  }\r\n\r\n  let decodedToken\r\n  try {\r\n    decodedToken = jwt.verify(token, process.env.SECRET_KEY)\r\n  } catch (error) {\r\n    error.statusCode = 401\r\n    throw error\r\n  }\r\n\r\n  if (!decodedToken) {\r\n    const error = new Error('Not authenticated.')\r\n    error.statusCode = 401\r\n    throw error\r\n  }\r\n\r\n  const role = decodedToken.role\r\n\r\n  const authorised = expectedRole.includes(role)\r\n  if (!authorised) {\r\n    const error = new Error('Not authorised.')\r\n    error.statusCode = 401\r\n    throw error\r\n  }\r\n\r\n  req.user = decodedToken\r\n  next()\r\n}<\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-336be06 elementor-widget elementor-widget-text-editor\" data-id=\"336be06\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>This middleware has been prepared and exported. Therefore, we need to include it in our routes file and pass it to the expected role, so in our JWT middleware, we will validate the request with the JWT token, then verify that the user has access to an expected role (this role saved in the database) to this endpoint.<\/p><h2>Routes File<\/h2>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-69a8175 elementor-widget elementor-widget-code-highlight\" data-id=\"69a8175\" data-element_type=\"widget\" data-widget_type=\"code-highlight.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"prismjs-default copy-to-clipboard \">\n\t\t\t<pre data-line=\"\" class=\"highlight-height language-javascript \">\n\t\t\t\t<code readonly=\"true\" class=\"language-javascript\">\n\t\t\t\t\t<xmp> const express = require('express')\r\n const router = express.Router()\r\n\r\n const auth = require('.\/auth\/index')\r\n const admin = require('.\/admin\/index')\r\n const common = require('.\/common\/index')\r\n const authorize = require('..\/middleware\/jwtAuth')\r\n\r\n router.use('\/auth', auth)\r\n router.use('\/admin', authorize(['admin']), admin)\r\n router.use('\/common', authorize(['admin', 'user']), common)\r\n\r\n module.exports = router <\/xmp>\n\t\t\t\t<\/code>\n\t\t\t<\/pre>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ebcec2b elementor-widget elementor-widget-text-editor\" data-id=\"ebcec2b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Now that we have set up our authentication and authorization middleware in our routes, we are passing the required role to access these routes. These roles will be checked against our user role.<\/p><p>\u00a0<\/p><p>Our middleware simply next() the request if the user has a valid JWT token and is authorized to access this route, otherwise, it will throw the global error that is caught by the express global error handler.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n    <div class=\"xs_social_share_widget xs_share_url after_content \t\tmain_content  wslu-style-1 wslu-share-box-shaped wslu-fill-colored wslu-none wslu-share-horizontal wslu-theme-font-no wslu-main_content\">\n\n\t\t\n        <ul>\n\t\t\t        <\/ul>\n    <\/div> \n","protected":false},"excerpt":{"rendered":"<p>Overview A Node.js library for use as Express middleware to secure endpoints with JWTs. The implementation uses a JWT&#8230;<\/p>\n","protected":false},"author":2,"featured_media":2359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"postBodyCss":"","postBodyMargin":[],"postBodyPadding":[],"postBodyBackground":{"backgroundType":"classic","gradient":""},"two_page_speed":[],"footnotes":""},"categories":[48],"tags":[43,51,50,14,49],"class_list":["post-2348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nodejs","tag-javascript","tag-nodejs","tag-security","tag-tips","tag-website"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Secure NodeJS APIs Using JWT &amp; Custom Auth<\/title>\n<meta name=\"description\" content=\"Secure Node.js Express APIs with best practices, implement JWT authentication, custom authorization, secure headers, and error handling.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Secure NodeJS APIs Using JWT &amp; Custom Auth\" \/>\n<meta property=\"og:description\" content=\"Secure Node.js Express APIs with best practices, implement JWT authentication, custom authorization, secure headers, and error handling.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog | InfyOm Technologies\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infyom\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-08T11:16:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-17T09:39:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif\" \/>\n\t<meta property=\"og:image:width\" content=\"772\" \/>\n\t<meta property=\"og:image:height\" content=\"484\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/gif\" \/>\n<meta name=\"author\" content=\"InfyOm\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@InfyOm\" \/>\n<meta name=\"twitter:site\" content=\"@InfyOm\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InfyOm\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\"},\"author\":{\"name\":\"InfyOm\",\"@id\":\"https:\/\/infyom.com\/blog\/#\/schema\/person\/659bfc844c333d041221e83c5f5ec754\"},\"headline\":\"Secure NodeJS APIs Using JWT &#038; Custom Auth\",\"datePublished\":\"2022-11-08T11:16:48+00:00\",\"dateModified\":\"2025-07-17T09:39:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\"},\"wordCount\":229,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infyom.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif\",\"keywords\":[\"JavaScript\",\"NodeJS\",\"Security\",\"Tips\",\"Website\"],\"articleSection\":[\"NodeJS\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\",\"url\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\",\"name\":\"Secure NodeJS APIs Using JWT & Custom Auth\",\"isPartOf\":{\"@id\":\"https:\/\/infyom.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif\",\"datePublished\":\"2022-11-08T11:16:48+00:00\",\"dateModified\":\"2025-07-17T09:39:47+00:00\",\"description\":\"Secure Node.js Express APIs with best practices, implement JWT authentication, custom authorization, secure headers, and error handling.\",\"breadcrumb\":{\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage\",\"url\":\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif\",\"contentUrl\":\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif\",\"width\":772,\"height\":484,\"caption\":\"Securing NodeJS Express APIs with JWT Authentication and custom Authorization\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infyom.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Secure NodeJS APIs Using JWT &#038; Custom Auth\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infyom.com\/blog\/#website\",\"url\":\"https:\/\/infyom.com\/blog\/\",\"name\":\"Blog | InfyOm Technologies\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/infyom.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infyom.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infyom.com\/blog\/#organization\",\"name\":\"InfyOm Technologies\",\"url\":\"https:\/\/infyom.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infyom.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/InfyOm-Logo.png\",\"contentUrl\":\"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/InfyOm-Logo.png\",\"width\":88,\"height\":41,\"caption\":\"InfyOm Technologies\"},\"image\":{\"@id\":\"https:\/\/infyom.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infyom\",\"https:\/\/x.com\/InfyOm\",\"https:\/\/www.instagram.com\/infyomtechnologies\/\",\"https:\/\/in.linkedin.com\/company\/infyom-technologies\",\"https:\/\/github.com\/infyomlabs\",\"https:\/\/x.com\/infyom\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infyom.com\/blog\/#\/schema\/person\/659bfc844c333d041221e83c5f5ec754\",\"name\":\"InfyOm\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infyom.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1ad162864d8d33c04ea9e6d0333cc483?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1ad162864d8d33c04ea9e6d0333cc483?s=96&d=mm&r=g\",\"caption\":\"InfyOm\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Secure NodeJS APIs Using JWT & Custom Auth","description":"Secure Node.js Express APIs with best practices, implement JWT authentication, custom authorization, secure headers, and error handling.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/","og_locale":"en_US","og_type":"article","og_title":"Secure NodeJS APIs Using JWT & Custom Auth","og_description":"Secure Node.js Express APIs with best practices, implement JWT authentication, custom authorization, secure headers, and error handling.","og_url":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/","og_site_name":"Blog | InfyOm Technologies","article_publisher":"https:\/\/www.facebook.com\/infyom","article_published_time":"2022-11-08T11:16:48+00:00","article_modified_time":"2025-07-17T09:39:47+00:00","og_image":[{"width":772,"height":484,"url":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif","type":"image\/gif"}],"author":"InfyOm","twitter_card":"summary_large_image","twitter_creator":"@InfyOm","twitter_site":"@InfyOm","twitter_misc":{"Written by":"InfyOm","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#article","isPartOf":{"@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/"},"author":{"name":"InfyOm","@id":"https:\/\/infyom.com\/blog\/#\/schema\/person\/659bfc844c333d041221e83c5f5ec754"},"headline":"Secure NodeJS APIs Using JWT &#038; Custom Auth","datePublished":"2022-11-08T11:16:48+00:00","dateModified":"2025-07-17T09:39:47+00:00","mainEntityOfPage":{"@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/"},"wordCount":229,"commentCount":0,"publisher":{"@id":"https:\/\/infyom.com\/blog\/#organization"},"image":{"@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage"},"thumbnailUrl":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif","keywords":["JavaScript","NodeJS","Security","Tips","Website"],"articleSection":["NodeJS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/","url":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/","name":"Secure NodeJS APIs Using JWT & Custom Auth","isPartOf":{"@id":"https:\/\/infyom.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage"},"image":{"@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage"},"thumbnailUrl":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif","datePublished":"2022-11-08T11:16:48+00:00","dateModified":"2025-07-17T09:39:47+00:00","description":"Secure Node.js Express APIs with best practices, implement JWT authentication, custom authorization, secure headers, and error handling.","breadcrumb":{"@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#primaryimage","url":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif","contentUrl":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization-1.gif","width":772,"height":484,"caption":"Securing NodeJS Express APIs with JWT Authentication and custom Authorization"},{"@type":"BreadcrumbList","@id":"https:\/\/infyom.com\/blog\/best-practices-securing-nodejs-express-apis-with-jwt-authentication-and-custom-authorization\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infyom.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Secure NodeJS APIs Using JWT &#038; Custom Auth"}]},{"@type":"WebSite","@id":"https:\/\/infyom.com\/blog\/#website","url":"https:\/\/infyom.com\/blog\/","name":"Blog | InfyOm Technologies","description":"","publisher":{"@id":"https:\/\/infyom.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infyom.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infyom.com\/blog\/#organization","name":"InfyOm Technologies","url":"https:\/\/infyom.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infyom.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/InfyOm-Logo.png","contentUrl":"https:\/\/infyom.com\/blog\/wp-content\/uploads\/2024\/06\/InfyOm-Logo.png","width":88,"height":41,"caption":"InfyOm Technologies"},"image":{"@id":"https:\/\/infyom.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infyom","https:\/\/x.com\/InfyOm","https:\/\/www.instagram.com\/infyomtechnologies\/","https:\/\/in.linkedin.com\/company\/infyom-technologies","https:\/\/github.com\/infyomlabs","https:\/\/x.com\/infyom"]},{"@type":"Person","@id":"https:\/\/infyom.com\/blog\/#\/schema\/person\/659bfc844c333d041221e83c5f5ec754","name":"InfyOm","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infyom.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1ad162864d8d33c04ea9e6d0333cc483?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1ad162864d8d33c04ea9e6d0333cc483?s=96&d=mm&r=g","caption":"InfyOm"}}]}},"_links":{"self":[{"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/posts\/2348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/comments?post=2348"}],"version-history":[{"count":15,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/posts\/2348\/revisions"}],"predecessor-version":[{"id":8195,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/posts\/2348\/revisions\/8195"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/media\/2359"}],"wp:attachment":[{"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/media?parent=2348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/categories?post=2348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infyom.com\/blog\/wp-json\/wp\/v2\/tags?post=2348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}