title: how to protect a route from being used until after they verified?
body: <p>Assume the user wants to go to their settings page where they could change their personal info (e.g. first name). I want to trigger an OTP sent to their phone to verify it is actually the user going to this page before they could actually update their info. We use a third party service that handles the sms part (expiration, error message etc). I have the whole sending + updating part figured out, I'm just unsure on how to protect the update route only after they're verified.</p>
  <p>Does anyone know what the best practice with this use case? i would be grateful for any help.</p>
  <pre><code>/* verifies if the access token (which user gets upon login) is valid */
  const auth = (req, res, next) =&gt; {
    const token = req.header('access-token');
    if (!token) return res.status(401).json('Not Authorized');
  
    try {
      const payload = jwt.verify(token, 'secret');
      req.userId = payload.userId
      next();
    } catch (ex) {
      res.status(400).json('Invalid.');
    }
  };
  
  
  /* sends one time password to user */
  router.post(
    '/update/user-check/send',
    auth,
    async (req, res) =&gt; {
      try {
  
        // gets user from db
        const curUser = await getUser({
          userId: req.userId,
        });
  
        // sends otp
        await SMSService.sendOneTimePasswordThroughPhone(curUser.phoneNumber)
  
        res.status(200).json(&quot;sent one time password&quot;)
  
      } catch (e) {
        console.log(e);
        return res.status(401).json(e);
      }
    },
  );
  
  /* verifies one time password to user */
  router.post(
    '/update/user-check/verify',
    auth,
    async (req, res) =&gt; {
      try {
  
        const oneTimePassword = req.body.oneTimePassword
  
        // gets user from db
        const curUser = await getUser({
          userId: req.userId,
        });
  
        // checks otp
        const result = await SMSService.checkOTP(oneTimePassword, curUser.phoneNumber);
        res.status(200).json(&quot;verified&quot;)
  
      } catch (e) {
        return res.status(401).json(e);
      }
    },
  );
  
  
  /* updates user's first name */
  router.put(
    '/update/first-name',
    auth,
    async (req, res) =&gt; {
      try {
        // updates first name
        const curUser = await updateFirstName({
          userId: req.userId,
        });
        res.status(200).json(&quot;updated first name&quot;)
      } catch (e) {
        return res.status(401).json(e);
      }
    },
  );
  </code></pre>
  <p>There is one big flaw with my implementation. I have no way to ensure '/update/first-name' route is protected only after they are validated. How do I go about this ? For example, currently if they use the put route and they haven't verified otp yet, then it would still allow them to use that route</p>