How would you implement role-based access control (RBAC)?
Model answer
Store a role (or permissions) on the user, include it in the token or load it from the database, and check it in middleware: requireRole('admin'). Enforce it on the server for every route, not just by hiding buttons. For finer control combine roles with ownership checks, and log sensitive admin actions.
Learn this topic
Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.