Middleware for private endpoints

server.js

app.use(function(req, res, next){
    //check header or url parameters or post parameters for token
    var token = req.body.token || req.query['token'] || req.headers['x-access-token'];
    //decode token
    if(token){
        //verifiy secret
        jwt.verify(token, config.SECRET, function(err, decoded){
            if(err){
                return res.status(401).send({ 
                    message: 'Failed to authenticate token.'
                });
            } else{
                //if everything is good, save to request for use in other reoutes
                req.user = decoded;
                next();
            }
        })
    } else {
        //if there is no token
        //return an HTTP response of 403 (access forbidden ) and an error message
        return res.status(403).send({
            message: 'No token provided.'
        });
    }
});