title: What is the proper way to restrict API access based on user type?
body: <p>Suppose I have two users, A and B. <br></p>
  
  <p>A is allowed to access all the resources available, but B can access them only partially.<br></p>
  
  <p>What is the proper way to prevent B from accessing resources to which B does not have permission?</p>
  
  <p>Should I create some sort of whitelist that specifies only URLs B can access?</p>
  
  <p>The following snippet is what I currently have.
  It is a middleware which checks whether each request is allowed to access specific URLs.</p>
  
  <pre><code>const ALLOWED_URLS = ['api/resource1', 'api/resource2', 'api/resource3'];
  const sessionCheck = (req, res, next) =&gt; {
     const url = req.originalUrl;
     // check whether accessing URL is allowed
  }
  </code></pre>
  
  <p>Is there any better approach than this?</p>