I am build backend server. I use express.js, jsonwebtoken and cookie-parser for user authentication. I define middleware functions:
<code>const protect = catchAsync(async (req, res, next) => {
// 1) Getting token and check of it's there
let token;
if (req.cookies.jwt) {
token = req.cookies.jwt;
}
if (!token) {
return next(
new AppError('You are not logged in! Please log in to get access.', 401)
);
}
const decoded = await promisify(jwt.verify)(token, process.env.JWT_SECRET);
const currentUser = await Users.findByPk(decoded.id);
if (!currentUser) {
return next(
new AppError(
'The user belonging to this token does no longer exist.',
401
)
);
}
req.user = currentUser.toJSON();
return next();
});
</code>
<code>const protect = catchAsync(async (req, res, next) => {
// 1) Getting token and check of it's there
let token;
if (req.cookies.jwt) {
token = req.cookies.jwt;
}
if (!token) {
return next(
new AppError('You are not logged in! Please log in to get access.', 401)
);
}
const decoded = await promisify(jwt.verify)(token, process.env.JWT_SECRET);
const currentUser = await Users.findByPk(decoded.id);
if (!currentUser) {
return next(
new AppError(
'The user belonging to this token does no longer exist.',
401
)
);
}
req.user = currentUser.toJSON();
return next();
});
</code>
const protect = catchAsync(async (req, res, next) => {
// 1) Getting token and check of it's there
let token;
if (req.cookies.jwt) {
token = req.cookies.jwt;
}
if (!token) {
return next(
new AppError('You are not logged in! Please log in to get access.', 401)
);
}
const decoded = await promisify(jwt.verify)(token, process.env.JWT_SECRET);
const currentUser = await Users.findByPk(decoded.id);
if (!currentUser) {
return next(
new AppError(
'The user belonging to this token does no longer exist.',
401
)
);
}
req.user = currentUser.toJSON();
return next();
});
After I do restrictTo :
<code>const restrictTo = async (req, res, next) => {
const { permissions } = req.user.role;
permissions.forEach((element) => {
const { method, path, name } = element;
if (req.method.toLowerCase() === method.toLowerCase()) {
const ok = checkUrl(req.originalUrl, path);
if (ok) {
console.log('gedo');
return next();
}
}
});
return next(new AppError('you dont have permission', 403));
};
</code>
<code>const restrictTo = async (req, res, next) => {
const { permissions } = req.user.role;
permissions.forEach((element) => {
const { method, path, name } = element;
if (req.method.toLowerCase() === method.toLowerCase()) {
const ok = checkUrl(req.originalUrl, path);
if (ok) {
console.log('gedo');
return next();
}
}
});
return next(new AppError('you dont have permission', 403));
};
</code>
const restrictTo = async (req, res, next) => {
const { permissions } = req.user.role;
permissions.forEach((element) => {
const { method, path, name } = element;
if (req.method.toLowerCase() === method.toLowerCase()) {
const ok = checkUrl(req.originalUrl, path);
if (ok) {
console.log('gedo');
return next();
}
}
});
return next(new AppError('you dont have permission', 403));
};
Here I simple define route:
router.route('/').get(protect, restrictTo, getAllCountry);
I get response successfully. But when see console.log I see this error:
<code>Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
at new NodeError (node:internal/errors:405:5)
</code>
<code>Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
at new NodeError (node:internal/errors:405:5)
</code>
Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
at new NodeError (node:internal/errors:405:5)
How can I fix this?
I just looked your code and it seems like you made a small mistake in your restrictTo function. You used a forEach loop and return next(); is executed again after the response has already been sent. To fix this, you can use a flag variable and if the flag has correct value, return next(); is executed.
I provide updated code:
<code>const restrictTo = (req, res, next) => {
const { permissions } = req.user.role;
let isRightPermission = false;
permissions.forEach((element) => {
const { method, path, name } = element;
if (req.method.toLowerCase() === method.toLowerCase()) {
const ok = checkUrl(req.originalUrl, path);
if (ok) {
isRightPermission = true;
}
}
});
if (isRightPermission) {
return next();
}
return next(new AppError('You don’t have permission', 403));
};
</code>
<code>const restrictTo = (req, res, next) => {
const { permissions } = req.user.role;
let isRightPermission = false;
permissions.forEach((element) => {
const { method, path, name } = element;
if (req.method.toLowerCase() === method.toLowerCase()) {
const ok = checkUrl(req.originalUrl, path);
if (ok) {
isRightPermission = true;
}
}
});
if (isRightPermission) {
return next();
}
return next(new AppError('You don’t have permission', 403));
};
</code>
const restrictTo = (req, res, next) => {
const { permissions } = req.user.role;
let isRightPermission = false;
permissions.forEach((element) => {
const { method, path, name } = element;
if (req.method.toLowerCase() === method.toLowerCase()) {
const ok = checkUrl(req.originalUrl, path);
if (ok) {
isRightPermission = true;
}
}
});
if (isRightPermission) {
return next();
}
return next(new AppError('You don’t have permission', 403));
};
0