ExpressJS - make route accessible only from internal redirect

user_9990279 0
Viewed 452

I have an ExpressJS app with some routes that I don't want to work when typed into the url, they should work only when I redirect to them from my code.

Meaning, if an user types "myapp.com/url" it should not work. But if I add res.redirect("/url") in my code, it works

express node.js routes javascript
2 Answers

basically you can't prevent a client from sending an HTTP request to an endpoint (you can't make it "not work"). Having said that your requirements aren't that different from a login logic using JWT.

You can use JWT to set which endpoints the client can gain access to. If the client is not permitted you will redirect him to a different page.

See: https://github.com/auth0/express-jwt

Update (see comments): when submitting the form you should generate a UUID for the request. This UUID will be a token that represents a temporary resource (video).

This is how the API will look more or less.

  1. POST /submit
  2. GET /generated/:UUID
  3. GET /download/:UUID

You will need to implement some logic that will manage this temporary resource.

user_14296180

This is not possible as res.redirect (https://expressjs.com/en/4x/api.html#res.redirect) accept the routes which are already available via URL. If you don't want to publish the route to the outside world, you might do some sort of authorization before displaying or sending data.

user_140794970
Related