title: RESTful API in Node.js - Is Filtering Possible With Authorization
body: <p>I have a web application and a RESTful API to communicate with the DB. The frontend of the web application posts/gets/puts to the backend with Angular HTTP, which in turn handles authentication, posts/gets/puts to the api and returns the result. The backend authenticates itself as an admin to the API via JWT, but authenticates the users with cookie based sessions. So, in a way the API is stateless but the web server uses states.</p>
  
  <p>I have been looking for options to have an authorization mechanism to filter query results based on users. For example I have a questions endpoint where I return a list of questions only created by the company of the logged in user.</p>
  
  <p>1- I have been doing on the web server (basically filtering):</p>
  
  <pre><code>router.get('/questions', passportConf.isAuthenticated, function(req, res) {
      restler.get(process.env.API_URL + '/questions/?organisation=' + req.user.organisation._id).on('complete', function(questions) {
        res.json({
          data: questions
        });
      });
  });
  </code></pre>
  
  <p>2- However the other option is the put questions endpoint nested under the user's organisation endpoint, such as:</p>
  
  <pre><code>/user/organisation/questions
  </code></pre>
  
  <p>3- Or basically I can put the user in the body of the request made to the API, which will filter based on the organisation of the user that is on the body of the request.</p>
  
  <p>4- Finally, I can skip the cookie based session auth on the web server, make my request directly to the API from frontend and authenticate users using JWT (which is the same how to filter question in the first point). </p>
  
  <p>I am fairly new to Node.js and I was wondering if there's a module or a common practice to handle particularly filtering in 1 or 4.</p>