Bdtjtk

I have a route that goes to the index page. I have a secret token that allows access to this page. I want to compare the requested URL with a custom string. The current URL in use is http://localhost:3000/?token=secret but if I enter http://localhost:3000/as?token=secret it doesn't render the 404 error page that I created, instead says Cannot GET /as. I wondering how to validate this and render out the error page correctly

app.get('/', (req, res) => {

    console.log(req.url); // /?token=secret

    if (req.url !== `/?token=${websocket_token}`) {

        res.render('error', {

            title: '404 Not Found',

            errorMessage: '404 Not Found'

        });

        return;

    }

});

In Express each app.get or other related method handles it's own route. So when you do app.get('/' you are only matching routes that are / not /as.

You could change it to * to match all routes. Maybe like the following?

app.get('*', (req, res) => {

    console.log(req.url); // /?token=secret

    if (req.url !== `/?token=${websocket_token}`) {

        res.render('error', {

            title: '404 Not Found',

            errorMessage: '404 Not Found'

        });

        return;

    }

});

Or of course you could have a dedicated section for your 404 messages.

app.get('/', (req, res, next) => {

    console.log(req.url); // /?token=secret

    if (req.url !== `/?token=${websocket_token}`) {

        return next();

    }

    // Valid request

});



app.get('*', (req, res) => {

    res.render('error', {

        title: '404 Not Found',

        errorMessage: '404 Not Found'

    });

});

At the end of the day there are so many ways you can handle Express routing. It's very powerful and flexible.

I'd suggest you look here under the How do I handle 404 responses? section for another idea as well.

Also, remember, having secrets in a URL like that, probably isn't the most secure thing. So there are a lot of reasons I wouldn't suggest this for security reasons. But just answering your question, the above should work.

The idiomatic way to handle 404s in Express is to register your final route handler with the use method rather than using one of the HTTP-specific methods.

app.use((req, res) => {

  res.render('error', {

    title: '404 not found',

    errorMessage: '404 not found'

  })

})

I emphasize the word final because use registers a catch-all handler, so this will override any route that it precedes in your code. If all your other routes are registered before this, then this will catch any request that has not matched any other route – regardless of the HTTP method that was used. So this will apply to any GET, POST, PUT, DELETE request.

An even more idiomatic way in Express to handle 404s (and all HTTP error responses) is to use the next argument that comes with all route handlers. This will re-route the request to the next handler that specifically takes an error as it's first argument:

app.use((req, res, next) => {

  const error = new Error('404 not found')

  error.statusCode = 404

  next(error)

})



app.use((error, req, res, next) => {

  res.status(error.status || 500)

  res.render('error', {

    title: error.message,

    errorMessage: error.message

  })

})

This is great because you now have a generic error handler, which you can access from inside any other route. So this will handle not only 404s, but also 401s, 403s, 503s, anything you want that doesn't render successfully for the user. And you can access this route simply by calling next with an error as the first argument from inside any other route handler.

I suggest you to use passport-auth-token for validating the token & display success or error pages.

Configure Strategy

The token authentication strategy authenticates users using a token. The strategy requires a verify callback, which accepts these credentials and calls done providing a user.

passport.use('authtoken', new AuthTokenStrategy(

  function(token, done) {

    AccessToken.findOne({

      id: token

    }, function(error, accessToken) {

      if (error) {

        return done(error);

      }



      if (accessToken) {

        if (!token.isValid(accessToken)) {

          return done(null, false);

        }



        User.findOne({

          id: accessToken.userId

        }, function(error, user) {

          if (error) {

            return done(error);

          }



          if (!user) {

            return done(null, false);

          }



          return done(null, user);

        });

      } else {

        return done(null);

      }

    });

  }

));

Authenticate Requests

Use passport.authenticate(), specifying the 'authtoken' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.post('/login',

  passport.authenticate(

    'authtoken',

    {

      session: false,

      optional: false

    }

  ),

  function(req, res) {

    res.redirect('/');

  }

);