Hybrid is common. Roles for coarse control (admin, user), permissions for fine control (post:delete, user:ban). A role grants a set of permissions. Store role -> permissions mapping in the DB or config. This balances simplicity and flexibility.
Add a role field on the user. Write an auth middleware that verifies the JWT and sets req.user. Write a requireRole factory that checks req.user.role. Apply to routes: router.use('/admin', auth, requireRole('admin')). Check resource ownership for user-specific resources.
401 Unauthorized means not authenticated (no token or invalid token). 403 Forbidden means authenticated but not authorized (wrong role or permission). Check auth first, then authorization.
Store permissions on the user (array of strings like 'post:delete', 'user:ban'). Write a requirePermission factory that checks req.user.permissions.includes(perm). More flexible than roles but harder to manage at scale.
Browse all our FAQs or reach out to our support team
Your learning library
Find your next course. Build something great.
