title: How to implement a secure REST API with node.js
body: <p>I start planning a REST API with node.js ,express and mongodb. The API provides data for a website (public and private area) and maybe later a mobile app. The frontend will be developed with AngularJS.</p>
  
  <p>For some days I read a lot about securing REST APIs, but I don’t get to a final solution. As far as I understand is to use HTTPS to provide a basic security. But how I can protect the API in that use cases:</p>
  
  <ul>
  <li><p>Only visitors/users of  the website/app are allowed to get data for the public area of the website/app</p></li>
  <li><p>Only authenticated and authorized users are allowed to get data for private area (and only data, where the user granted permissions)</p></li>
  </ul>
  
  <p>At the moment I think about to only allow users with a active session to use the API. To authorize the users I will use passport and for permission I need to implement something for myself. All on the top of HTTPS.</p>
  
  <p>Can somebody provide some best practice or experiences? Is there a lack in my “architecture”?</p>