Coding a news website,I'm trying to make authorization so that only the author (who posted the article) is able to edit and delete it (these buttons appear at the bottom of the page and are visible to all the users).
But then there are certain news/websites which don't have a login/sign up option. For example : http://www.denofgeek.com/us . Because they have no authentication, does this mean that they have no authorization? How are they able to edit/delete the articles if the settings for the authors are the same as the rest of the users ?
Code:
app.get("/blog/:id/:title/edit", function(req,res) {
Blog.findById(req.params.id, function(err, foundBlog) {
if(err) {
res.redirect("/blog");
} else {
res.render("editBlog", {blog : foundBlog});
}
})
})
//UPDATE BLOG
app.put("/blog/:id/:title", function(req,res) {
req.body.blog.body = req.sanitize(req.body.blog.body);
Blog.findByIdAndUpdate(req.params.id, req.body.blog,{new: true}, function(err,updatedBlog) {
if(err) {
res.redirect("/blog");
} else {
res.redirect("/blog/" + req.params.id + "/" + req.params.title);
}
})
})
How should I go about editing/deleting the articles if I don't want to use authentication?
P.S : I can, of course, remove the edit and delete buttons appearing on the page and send PUT and DELETE requests via Postman, but it's obviously a bad idea!
