Node.js(Express)项目登录认证中间件的合理放置方案咨询

Great question—let’s break this down step by step since you’re already structuring your Express app with a clean models/routes/controllers separation, which puts you in a great position to implement middleware efficiently!

1. Optimal Placement for Middleware #

Your use case perfectly maps to two common, effective middleware placement patterns in Express:

• Global/Application-Level Middleware: For routes that all require authentication (like user profiles, dashboards, etc.), mount the middleware directly in server.js using app.use(). Just make sure to place it before you mount your route handlers—otherwise, the routes will execute before the middleware runs.
  Example in server.js:

  const { authenticateUser } = require('./middleware/auth');
  // 全局挂载：所有后续路由默认需要登录验证
  app.use(authenticateUser);
  // 然后挂载你的路由
  app.use('/api/users', require('./routes/users'));
  app.use('/api/dashboard', require('./routes/dashboard'));
  

• Route-Level Middleware: For routes with mixed requirements (like your article routes), mount the middleware directly in the route file, targeting only the specific endpoints that need it. This keeps your logic granular and avoids over-restricting public-facing routes.
  Example in routes/articles.js:

  const { authenticateUser } = require('../middleware/auth');
  const articleController = require('../controllers/articles');
  const router = require('express').Router();
  
  // 所有人可查看文章：无需验证中间件
  router.get('/', articleController.getAllArticles);
  router.get('/:id', articleController.getSingleArticle);
  
  // 仅登录用户可操作评论：挂载验证中间件
  router.post('/:id/comments', authenticateUser, articleController.addComment);
  router.delete('/:id/comments/:commentId', authenticateUser, articleController.deleteComment);
  
  module.exports = router;
  

2. Should You Make It a Global Function? #

Absolutely—this is the gold standard best practice. Instead of writing duplicate authentication logic across files, create a reusable middleware module in a dedicated middleware/ directory (add this to your existing structure!). This gives you a single source of truth for your authentication logic, making it trivial to update or modify later without hunting down scattered code.

Example reusable middleware (middleware/auth.js):

const authenticateUser = (req, res, next) => {
  // 你的验证逻辑：检查session、JWT token、req.user等
  if (!req.isAuthenticated()) {
    return res.status(401).json({ message: '请先登录以访问此资源' });
  }
  // 验证通过，继续执行下一个中间件/控制器
  next();
};

module.exports = { authenticateUser };

3. Do You Have to Require It in Multiple Route Files? #

You will need to require() the middleware module in each route file that uses it, but this is not a drawback—it’s actually a good thing. Requiring the middleware explicitly in each route file makes your code self-documenting: anyone reading the route file can immediately see which endpoints require authentication, no need to cross-reference server.js.

That said, you’re not repeating logic—you’re just importing the same reusable function from your middleware/auth.js module every time. This keeps your code DRY (Don’t Repeat Yourself) while maintaining clarity and control over where authentication is enforced.

Bonus Pro Tip #

If you have a group of routes that mostly require authentication but have a few exceptions, you can mount the middleware at the router level instead of globally, then skip it for specific endpoints:

// routes/articles.js
const router = require('express').Router();
const { authenticateUser } = require('../middleware/auth');

// 给整个文章路由挂载中间件
router.use(authenticateUser);
// 跳过GET文章列表的验证
router.get('/', (req, res, next) => {
  next(); // 直接跳过验证，执行控制器
}, articleController.getAllArticles);

// 其他路由自动使用验证中间件
router.post('/:id/comments', articleController.addComment);

内容的提问来源于stack exchange，提问作者Majkeee