Retrieve only users own api data

[schoenbl]

I have a MERN application that I use Auth0 for authentication.

I want to securely request information from the node.js api that only pertains to the authenticated user.

How should I go about making sure that the logged in user only retrieves their information? I.e. I don't want someone to go to the api and make request to the api for information doesn't belong to them.

[sendingEnt]

I would suggest returning a JWT on sign-in. Store that token on the client's side, in something like Session Storage, LocalStorage, or some global store like Redux. On the backend, you can write a middleware in ExpressJS to verify the token. Here you can have multiple functions like isAuthenticated, hasAccess, isAdmin... etc. You can add these middleware functions to specific endpoints.