2

I am trying to restrict access to some elements on a web page for each kind of user after they pass their credentials through a login page.

The logic for accomplishing this is the following:

  1. The user enters their credentials on the login page.
  2. if the user enters the correct credentials nodejs will redirect to the dashboard

The following code is a partial code that shows how the users will be redirected to the dashboard endpoint (I prefer not to show the full code with complete validations in order to simplify this question)

// nodejs code in the server
app.post('/users/api', function(req, res) {
    res.redirect('/dashboard');
}

I have in mind the following approach:

Together with the "res.redirect" send some headers to catch them when the dashboard.html page is ready (with JQuery ready function) and write some function for hiding elements on the page if the user has privileges or not.

The thing is that I've performed research but so far is not clear for me how to do this and if this is the correct approach.

Any help to build this code is welcome.

naib khan
  • 928
  • 9
  • 16
israel
  • 57
  • 6
  • Just so you’re aware, hiding elements on the client is not a secure way to keep privileged information secret. This approach is fine if you’re doing homework for school, but in the real world, you need to only have the server send the information if the user is allowed to see it, otherwise anyone with any sort of computer knowledge can easily bypass your element hiding. – Nate Jul 07 '19 at 06:14
  • Possible duplicate of [Node.JS: How to send headers with form data using request module](https://stackoverflow.com/questions/17121846/node-js-how-to-send-headers-with-form-data-using-request-module) – Freddy Jul 07 '19 at 06:28
  • Nate, this is for school project – israel Jul 07 '19 at 06:47

2 Answers2

1

You can set Authorization field in the header.

For Authorization you need to use username:password combination by encoding Base64 string.

var username = 'xyz';
var password = '123';
//  The server expects the data to be encoded in Base64.
var auth = 'Basic ' + Buffer.from(username + ':' + password).toString('base64');

var header = {'Host': 'www.example.com', 'Authorization': auth};
var request = client.request('GET', '/', header);
naib khan
  • 928
  • 9
  • 16
0

You can set header like below in response res.setHeader('Content-Type','text/html);

Pramod Kharade
  • 2,005
  • 1
  • 22
  • 41