lib/middleware.js
function () {
    return function (req, res, next) {
      var userModel = models.user;

      if (req.url.indexOf('/api') === 0) {
        req.isApi = true;

        // Make the API requests stateless by removin the cookie set by middleware cookieSession
        onHeaders(res, () => res.removeHeader('Set-Cookie'));

        if (config.api.requireSSL) {
          if (!req.secure && (String(req.headers['x-forwarded-proto']).toLowerCase() !== 'https') ) {
            res.status(403); // forbidden
            res.json({ error: 'All API requests must be made over SSL/TLS' });
            return;
          }
        }

        if (req.query.api_key) {
          req.apiKey = req.query.api_key;
        } else if (req.headers.authorization) {
          req.apiKey = req.headers.authorization.replace(/token\s/i,'');
        }

        var validateApiRequest = function () {
          if (config.api.allowAnonymousReadWrite || (config.api.allowAnonymousRead && req.method === 'GET')) {
            next();
          } else {
            if (!req.apiKey) {
              res.status(403); // forbidden
              res.json({ error: 'You need to provide a valid API key when using this API' });
            } else {
              next();
            }
          }
        };

        if (req.apiKey) {
          userModel.loadByApiKey(req.apiKey, function (err, user) {
            if (err) {
              return next(err);
            }
            if (user) {
              req.session.user = user;

              // since we're setting the user session via the API
              // we need to ensure that the user is totally trashed
              // from the session to avoid abuse directly in the browser
              // i.e. stolen api key can only create bins, nothing more.
              onHeaders(res, () => delete req.session);

              validateApiRequest();
            } else {
              res.status(403); // forbidden
              res.json({ error: 'The API key you provided is not valid' });
            }
          });
        } else {
          validateApiRequest();
        }
      } else {
        next();
      }
    };
  }
function () {
    return function (req, res, next) {
      var userModel = models.user;

      if (req.url.indexOf('/api') === 0) {
        req.isApi = true;

        // Make the API requests stateless by removin the cookie set by middleware cookieSession
        onHeaders(res, () => res.removeHeader('Set-Cookie'));

        if (config.api.requireSSL) {
          if (!req.secure && (String(req.headers['x-forwarded-proto']).toLowerCase() !== 'https') ) {
            res.status(403); // forbidden
            res.json({ error: 'All API requests must be made over SSL/TLS' });
            return;
          }
        }

        if (req.query.api_key) {
          req.apiKey = req.query.api_key;
        } else if (req.headers.authorization) {
          req.apiKey = req.headers.authorization.replace(/token\s/i,'');
        }

        var validateApiRequest = function () {
          if (config.api.allowAnonymousReadWrite || (config.api.allowAnonymousRead && req.method === 'GET')) {
            next();
          } else {
            if (!req.apiKey) {
              res.status(403); // forbidden
              res.json({ error: 'You need to provide a valid API key when using this API' });
            } else {
              next();
            }
          }
        };

        if (req.apiKey) {
          userModel.loadByApiKey(req.apiKey, function (err, user) {
            if (err) {
              return next(err);
            }
            if (user) {
              req.session.user = user;

              // since we're setting the user session via the API
              // we need to ensure that the user is totally trashed
              // from the session to avoid abuse directly in the browser
              // i.e. stolen api key can only create bins, nothing more.
              onHeaders(res, () => delete req.session);

              validateApiRequest();
            } else {
              res.status(403); // forbidden
              res.json({ error: 'The API key you provided is not valid' });
            }
          });
        } else {
          validateApiRequest();
        }
      } else {
        next();
      }
    };
  }
function ( ) { return function ( req , res , next ) { var userModel = models . user ; if ( req . url . indexOf ( '/api' ) === 0 ) { req . isApi = true ; // Make the API requests stateless by removin the cookie set by middleware cookieSession onHeaders ( res , ( ) => res . removeHeader ( 'Set-Cookie' ) ) ; if ( config . api . requireSSL ) { if ( ! req . secure && ( String ( req . headers [ 'x-forwarded-proto' ] ) . toLowerCase ( ) !== 'https' ) ) { res . status ( 403 ) ; // forbidden res . json ( { error : 'All API requests must be made over SSL/TLS' } ) ; return ; } } if ( req . query . api_key ) { req . apiKey = req . query . api_key ; } else if ( req . headers . authorization ) { req . apiKey = req . headers . authorization . replace ( / token\s / i , '' ) ; } var validateApiRequest = function ( ) { if ( config . api . allowAnonymousReadWrite || ( config . api . allowAnonymousRead && req . method === 'GET' ) ) { next ( ) ; } else { if ( ! req . apiKey ) { res . status ( 403 ) ; // forbidden res . json ( { error : 'You need to provide a valid API key when using this API' } ) ; } else { next ( ) ; } } } ; if ( req . apiKey ) { userModel . loadByApiKey ( req . apiKey , function ( err , user ) { if ( err ) { return next ( err ) ; } if ( user ) { req . session . user = user ; // since we're setting the user session via the API // we need to ensure that the user is totally trashed // from the session to avoid abuse directly in the browser // i.e. stolen api key can only create bins, nothing more. onHeaders ( res , ( ) => delete req . session ) ; validateApiRequest ( ) ; } else { res . status ( 403 ) ; // forbidden res . json ( { error : 'The API key you provided is not valid' } ) ; } } ) ; } else { validateApiRequest ( ) ; } } else { next ( ) ; } } ; }
detect if this is an API request and add flag isApi to the request object
detect if this is an API request and add flag isApi to the request object