Sign Up for Free

RunKit +

Try any Node.js package right in your browser

This is a playground to test code. It runs a full Node.js environment and already has all of npm’s 400,000 packages pre-installed, including express-reaccess with all npm packages installed. Try it out:

var expressReaccess = require("express-reaccess")

This service is provided by RunKit and is not affiliated with npm, Inc or the package authors.

express-reaccess v2.0.1

Express/Connect middleware to manage API access on a RegExp basis


Express middleware to check user access based on the ressources URIs and HTTP methods.

NPM version Build status Dependency Status devDependency Status Coverage Status Code Climate Package Quality

See those slides to know more about the reaccess project principles.


var reaccess = require('express-reaccess');

  rightsProps: ['_rights'],
  valuesProps: ['_user'],

Assumming a middleware placed before the above example and adding properties like this on the request object for a given authenticated user:

req._user = {
  id: 1,
  login: 'nfroidure',
  organization: {
    id: 1,
    name: 'simplifield',
req._rights = [{
  path: '/users/:login',
  methods: reaccess.METHODS ^ reaccess.DELETE,
}, {
  path: '/organisations/',
  methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,
}, {
  path: 'public/(.*)',
  methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,

Then, the user will be able to access the following URI/method couples:

  • OPTIONS/HEAD/GET/PUT/POST - /users/nfroidure
  • OPTIONS/HEAD/GET - /organizations/simplifield
  • OPTIONS/GET/HEAD - /public/*

Warning: Since this middleware is based on RegExp, you have to be aware of RegExp special chars. By example, the following rules:

req._rights = [{
  path: '/blog/posts/([0-9]+)/?page=([0-9]+)',
  methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,

Will allow access to 'blog/posts/1page=1' which is probably not what you want. So, do not forget to escape special chars:

req._rights = [{
  path: '/blog/posts/([0-9]+)/\\?page=([0-9]+)',
  methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,

The best is to unit test your access rules. Note that the ^ and $ chars are respectively added to the begin/end of the regular expression before executing her.




Type: Object

The options of the reaccess middleware.


Type: Array of Strings Default: 'user.rights'

The properties in wich the user rights will be read. This property must be filled on the request object by any other middleware.

This property must contain an Array of object of this kind :

req.user.rights = [{
  path: '/organizations/:orgId/users.json'
  methods: reaccess.GET | reaccess.POST


Type: Array of Strings

The properties in which any templated value found in the path must be searched for.

By example, if the user rights are the following :

req.user.rights = [{
  path: '/organizations/'
  methods: reaccess.GET | reaccess.POST

He will be able to access this URI /organizations/1/users.json if a previously set middleware have set the to 1 and options.valuesProps to ['user'].


Type: Error constructor Default: Error

Allows to use your own Error contructor for reaccess access errors.


Type: String Default: Unauthorized access!

Allows to define your own error message. Note this middleware will not throw 401 responses for you. This is your responsibility to do so in your own error handler middleware. Defining a custom access error message could help detect when to answer with a 401 status code.

Static methods

express-reaccess comes with some convenience static methods to deal with methods properties.

boolean : reaccess.test(rights, values, method, path)

Return a boolean indicating if the given method/path matches the given rights.

[objects] : reaccess.getRightsFromReq(rightsProps, req)

Extract rights from the actual request.

[any] : reaccess.getValuesFromReq(valuesProps, req)

Extract template values from the actual request.

[strings] : reaccess.methodsAsStrings(methods)

Return an array of strings from the methods property of a right.

methods : reaccess.stringsToMethods(strings)

Return the methods value of a right from an array of strings.

Static properties

Reaccess use bitwise operators to match methods. The reaccess function provides static constants to help you make cleaner code.


Type: Number Value: 1


Type: Number Value: 2


Type: Number Value: 4


Type: Number Value: 8


Type: Number Value: 16


Type: Number Value: 32


Type: Number Value: 64


Type: Number Value: 7


Type: Number Value: 120


Type: Number Value: 127

Want more ?

express-reaccess supports multivalued path templates. The following rights/values couple:

req._rights = [{
  path: '/organizations/'
  methods: reaccess.GET | reaccess.POST
req.user.organizations = [{
  id: 1,
  name: 'FranceJS'
}, {
  id: 2,
  name: 'ChtiJS'
}]; = 3;

Will give access to GET/POST /organizations/1/users/3.json and GET/POST /organizations/2/users/3.json.

You also can use the express-reaccess middleware several times to bring a fine access control of your API to your consumers:

// Access control based on the pricing plan of the user organization
  rightsProps: ['pricingPlan.rights'],
  valuesProps: ['organization']

// Access control based on the user rights set per each organization administrator
  rightsProps: ['user.rights'],
  valuesProps: ['user']


To debug access checks, just use the DEBUG=express-reaccess environnement variable.

Note for AngularJS users

If you use AngularJS for your frontend, you may be interested by the angular-reaccess module.




RunKit is a free, in-browser JavaScript dev environment for prototyping Node.js code, with every npm package installed. Sign up to share your code.
Sign Up for Free