MERN Authentication Tutorial #14 - Protecting API Routes

Hey gang, in this MERN auth tutorial, you'll learn how to protect certain API routes from unauthenticated users.

⭐⭐ Get the full course now (without ads) on the Net Ninja Pro site:

⭐⭐ Get access to all free & PREMIUM courses on Net Ninja Pro:

🐱‍💻 Access the course files on GitHub:

🐱‍💻 MERN Stack Tutorial:

🐱‍💻 React Tutorial:

🔥🔥🔥 Other resources:

[rayturner]

Fantastic! Shaun you have a Natural Talent to teach, Your time, effort and knowledge is so appreciated I have learn't so much, keep it up Dude.

[dprotocoll]

I love the way the application is structured.

[ianengelbrecht]

I’m enjoying this tutorial a lot. Very nice way of structuring the app. Auth routes and workout routes in different files, only require auth middleware in the file where it’s needed, bang!

[hwaro_]

Thank you a lot Shaun for sharing such as this amazing lesson! You've brought a lot of people from fundamentals of web development to here
👏

[maskman]

Great lesson, have learned a lot, thank you Shaun 😀

[md.asifal-mahmud]

just wondering where is the "async" keyword.
edit: oops! it is at 12:48

[ammar]

the _id part is a little confusing.. why we don't use the _id directly without the request to the database?

[SaiBaba-zimy]

For me, the error is about the split function. Everything works fine initially, but as soon as I send the request, the backend server crashes and it points out the split() like it does not recognize the function and cannot read its properties.

[msaters]

I have one question. isn't findOne by id, when we want just id that we already have, important there. minute 9:14, could we skip this await and just pass there _id or some object made with this property

[AN-qwye]

Maybe one day you can teach use using react with typescript for authentication too?

[Anteater]

But how do you ensure that a workout is only visible to the user who made the workout? So the user has to be logged in but also the correct user?

[yuzuo]

Hi all, so when I'm destructuring the "authorization" property from headers, it looks like there's no such property inside headers, I console.log(authorization) and it returned "undefined", any suggestions? Thank you!

[selvaganeshm]

Hi Shaun, Could you please explain when to use

=> res.status().json() vs => return res.status().json()

Thanks in advance. We love you.

[omarzalama]

If we are grabbing the _id from the decoded token, why is it necessary to make an extra call to the DB to get the user._id? don't we have it already from the decoded token?

[jaikhatri]

I want apis to be accessible by owner only so how can I do it'

[nimeshganatra]

Implementation upto this point is not handling the condition that if there is no record in the database with the user id from the valid token.

[evbwe]

I have an error 401 even though I have authContext and logged in, my authorization is undefined :( now I'm stuck

[jesseswilson]

What's the best way about automatically logging the user out if the token expires? I've tried checking against expiration time in requireAuth and AuthContext but nothing seems to do anything? Thanks!

[faruksardar]

Hi can anyone explain how I can do the same in Nextjs, thank you in advance

[anandhukraju]

Would you consider deploying this express code to Lambda or App Runner at the end?🥲