title: Group/rule-based authorization approach in node.js and express.js
body: <p>What are good strategies for role-based authorization in express.js? Especially with express-resource?</p>
  
  <p>With <a href="https://github.com/visionmedia/express-resource">Express-resource</a> there are no handlers, so I think there are three options:</p>
  
  <ol>
  <li>Use a middleware</li>
  <li>Pass the authorization function to the resource and check each resource request separately</li>
  <li>Check authorization with every request right after authentication</li>
  </ol>
  
  <p>Are there any other solutions?</p>
  
  <p>Group/Role-based authorization is a pretty antique approach. Are there newer methods of access control? If not, how can role-based authorization be applied to node.js? Where to store group-rule relationships (with NoSQL/CouchDB/Redis)?</p>
  
  <p>As an example, the structure:</p>
  
  <pre><code>/
    /forums
      /forums/threads
  </code></pre>
  
  <p>Each resource with index, new, create, show, edit update and destroy. Some people can edit/delete etc. threads and forums, some people shouldn't.</p>