Release url that start one way

Question

I am using jwsonwebtoken and would like to release urls with dynamic ending that is to download files

For that I have the following code:

import * as jwt from 'jsonwebtoken'
import env from '../env';

const jwtMiddleware = deps =>{
    return async (req, res, next)=>{
        if( !deps.exclusions.includes( req.href() ) ){
            const token = req.headers['x-access-token']
            if( !token ){
                res.send( 403, {error: 'Token não fornecido'} )
                return false
            }
            try {
                req.decoded = jwt.verify( token, env.JWT_SECRET )
            } catch (error) {
                res.send( 403, { error: 'Falha ao autenticar o token'})
                return false
            }
        }
        next()
    }
}

export default jwtMiddleware

I delete url like this:

 routeProtect(){
        let exclusions = ['/api/usuario/login',
                          '/api/anexo/file/*']
        this.app.use( jwtMiddleware( {exclusions} ) )
    }

I would like to release all url starting with /api/attachment/file/ because the ending is dynamic:

http://localhost:300/api/anexo/file/yhml12ds.pdf

Answer 1

Using the code req.url.substr(0,req.url.lastIndexOf('/')), it leaves the url this way http://localhost:300/api/anexo/file.

So if the url you are requesting is /api/anexo/file the system will release to pass through, it is also even the ones you add in the delete array.

import * as jwt from 'jsonwebtoken'
    import env from '../env';

    const jwtMiddleware = deps =>{
        return async (req, res, next)=>{
            if( !deps.exclusions.includes(req.url.substr(0,req.url.lastIndexOf('/')))) ){
                const token = req.headers['x-access-token']
                if( !token ){
                    res.send( 403, {error: 'Token não fornecido'} )
                    return false
                }
                try {
                    req.decoded = jwt.verify( token, env.JWT_SECRET )
                } catch (error) {
                    res.send( 403, { error: 'Falha ao autenticar o token'})
                    return false
                }
            }
            next()
        }
    }

    export default jwtMiddleware


   routeProtect(){
        let exclusions = ['/api/usuario/login','/api/anexo/file/']
        this.app.use( jwtMiddleware( {exclusions} ) )
    }