Router runs middleware on routes, which are not in array.

[pantuchy]

node.js version: v10.16.3

npm/yarn and version: 6.13.4

@koa/router version: 8.0.5

koa version: 2.11.0

Code sample:

const Router = require('@koa/router')
const validate = require('../middlewares/validator')
const guard = require('../middlewares/guard')

const AccountController = require('../controllers/account')

const router = new Router({
   prefix: '/account'
})

router.use(router.routes(), guard.ip.filter())

router.use([
   '/signin',
   '/update',
   '/password/change',
   '/password/forgot',
   '/password/reset',
   '/email/change/request',
   '/email/change/confirm',
   '/email/verify'
], validate())

router.use([
   '/signout',
   '/',
   '/update',
   '/password/change',
   '/email/change/request'
], guard.user.passport('jwt'), guard.csrf())

// Routes
router.post('/signin', guard.user.passport('local'), AccountController.signIn)
router.delete('/signout', AccountController.signOut)

router.get('/', AccountController.profile)
router.post('/update', AccountController.update)

router.post('/password/change', AccountController.password.change)
router.post('/password/forgot', AccountController.password.forgot)
router.post('/password/reset', AccountController.password.reset)

router.post('/email/change/request', AccountController.email.change.request)
router.post('/email/change/confirm', AccountController.email.change.confirm)
router.post('/email/verify', AccountController.email.verify)

module.exports = router

Expected Behavior:

Expected, that route '/' will effect exactly for route '/', when using:
router.use([ '/signout', '/', '/update', '/password/change', '/email/change/request' ], guard.user.passport('jwt'), guard.csrf())
So that passport middleware should run exactly on those routes, which are is this array.

Actual Behavior:

Unfortunately route '/' in the array of routes above effects on any other route, even on '/signin', which is not in array for passport middleware.

Additional steps, HTTP request details, or to reproduce the behavior or a test case:

[julienw]

Maybe specify the route for signin before declaring this middleware.
The order of declaring routes and middlewares is important.

[julienw]

Another possibility is to declare different routers for your different concerns. In a specific router, Koa-router won't execute a middleware if there's no matching route. (I'd like to change this behavior in #44 though).

[pantuchy]

Maybe specify the route for signin before declaring this middleware.
The order of declaring routes and middlewares is important.

But if I will declare /signin route before declaring middleware, then middleware guard.user.passport('local') and controller will execute before validation middleware, am I right? If yes, then this is not, what I am expecting, because validation middleware should execute first, and only if validation succeeds, only then should run the rest middleware chain. With this approach I prevent unnecessary database queries to database, until validation will be successful.

[pantuchy]

Another possibility is to declare different routers for your different concerns. In a specific router, Koa-router won't execute a middleware if there's no matching route. (I'd like to change this behavior in #44 though).

Thank you for your advise, will think about it, may be it will be a solution.

[julienw]

I haven't worked with passport since ages so I can't advise more :-)

[pantuchy]

I haven't worked with passport since ages so I can't advise more :-)

Passport is just another middleware as well as controller 🙂

[julienw]

I've just found https://github.com/Foxandxss/koa-unless that might be interesting for your use case.

[aravindanve]

Another possibility is to declare different routers for your different concerns. In a specific router, Koa-router won't execute a middleware if there's no matching route. (I'd like to change this behavior in #44 though).

@julienw I really need this behaviour, how do I achieve this. I am using different auth middleware in different routers and all of them get called for some reason. see #90 (comment)

[julienw]

The problem in #90 is that both routes match the first middleware, so the behavior I'm mentioning doesn't work for this case.
What seems to work though is reversing the order of your routes. I'll leave a message in the other issue.