Question

I would like to create kind of a before filter which allows me to make the current user available in all actions. The followint approach works well and I didn’t even need to declare a global variable:

app.use(function(req, res, next){
    if(req.session.user_id){
        /* Get user from database
           and share it in a variable
           that can be accessed frooom ...
        */
        User.find({ /* ... */ }, function(err, users){
            if(users.length == 1){
                req.current_user = users[0];
            }
            next();
        });
    }
    else{
        next();
    }
});

app.get('/', function(req, res){
    // ... here!!
    console.log(req.current_user);
    res.render('index', {
        current_user: req.current_user,
    });
});

But I’m still unsure if it is okay to manipulate req because I don’t know if it’s right to change something that’s not owned by me? Is there a better way to do this?

Answer 1

It’s a common approach to extend req with session or user object

For example see these examples:

• Passport, a popular authentication library https://github.com/jaredhanson/passport/blob/master/lib/passport/strategies/session.js

• Connect middleware for cookie session https://github.com/senchalabs/connect/blob/master/lib/middleware/cookieSession.js