samples/sample3/handlers/sessions.js
function yourselfOnly(req, res, next) {
  // Get the username or sessionId from the URL
  var username = req.params.username;
  var sessionId = req.params.sessionId;

  if (!req.session) {
    res.status(401).send('You must be logged-in to access this resource');
  }
  else if (_.contains(req.session.user.roles, 'admin') ||
    (username && req.session.user.username === username) ||
    (sessionId && req.session.id === sessionId)) {
    next();
  }
  else {
    res.status(401).send('You can only perform this operation on your own account');
  }
}
function yourselfOnly(req, res, next) {
  // Get the username or sessionId from the URL
  var username = req.params.username;
  var sessionId = req.params.sessionId;

  if (!req.session) {
    res.status(401).send('You must be logged-in to access this resource');
  }
  else if (_.contains(req.session.user.roles, 'admin') ||
    (username && req.session.user.username === username) ||
    (sessionId && req.session.id === sessionId)) {
    next();
  }
  else {
    res.status(401).send('You can only perform this operation on your own account');
  }
}
function yourselfOnly ( req , res , next ) { // Get the username or sessionId from the URL var username = req . params . username ; var sessionId = req . params . sessionId ; if ( ! req . session ) { res . status ( 401 ) . send ( 'You must be logged-in to access this resource' ) ; } else if ( _ . contains ( req . session . user . roles , 'admin' ) || ( username && req . session . user . username === username ) || ( sessionId && req . session . id === sessionId ) ) { next ( ) ; } else { res . status ( 401 ) . send ( 'You can only perform this operation on your own account' ) ; } }
Prevents users from accessing another user's account.
Except for "admins", who can access any account.
Prevents users from accessing another user s account . Except for admins who can access any account .