Your Skills → Your Way → Your Work

Adding JWT Authentication

In this step, we're transforming our unprotected endpoint into a secure, authenticated route. The key changes involve importing our verifyToken utility function and implementing a token validation check before any data is returned to the client.

Line 13: We extract the JWT from the Authorization header. The ?.split(' ')[1] pattern safely handles the "Bearer token" format, returning undefined if the header is missing rather than throwing an error.

Lines 14-19: The guard clause checks two conditions: token existence AND validity. If either fails, we immediately return a 401 response with a descriptive error object. This early return pattern keeps our code flat and readable.

Lines 20-21: Only after successful authentication do we fetch and return user data. The response is now wrapped in a data property — this consistent structure makes it easier for frontend developers to handle API responses.

Next step: We'll refactor this into reusable middleware to avoid duplicating auth logic across multiple routes.

Extracting Reusable Middleware

Following the DRY (Don't Repeat Yourself) principle, we extract our authentication logic into a dedicated middleware function. This pattern is fundamental in Express.js — middleware functions have access to the request, response, and next function in the application's request-response cycle.

Line 7 — The key addition: After successful verification, we decode the token payload and attach it to req.user. This means any subsequent middleware or route handler can access the authenticated user's data without re-parsing the token.

Usage example: Now protecting a route is a one-liner. Simply add the middleware as the second argument: app.get('/api/users', authMiddleware, handler)