Implementing Role-Based Authentication in MEAN Stack

July 03, 2025

In modern web applications, controlling access to resources based on user roles is essential for security and proper user management. Role-based authentication allows you to assign different permissions to users like admins, editors, or general users. In a MEAN stack application—MongoDB, Express.js, Angular, and Node.js—implementing role-based authentication ensures that only authorized users can access specific routes or perform sensitive actions.

1️⃣ Define User Roles in MongoDB

The first step is to add a role field in your User schema. This field will store each user’s role, which determines their level of access. For example, using Mongoose:

const userSchema = new mongoose.Schema({

username: String,

password: String,

role: { type: String, enum: ['admin', 'editor', 'user'], default: 'user' }

});

Here, you define three roles: admin, editor, and user, with user as the default.

2️⃣ Generate JWT with Role Information

When a user logs in successfully, issue a JSON Web Token (JWT) that includes their role information. This allows you to identify and authorize the user with each request.

const token = jwt.sign(

{ id: user._id, role: user.role },

process.env.JWT_SECRET,

{ expiresIn: '1h' }

);

This token will be sent to the client and included in future requests for authorization.

3️⃣ Create Role-Based Middleware in Express

To protect backend routes, write middleware that checks both authentication and the user’s role. This middleware ensures only users with allowed roles can access certain routes:

function authorizeRoles(...allowedRoles) {

return (req, res, next) => {

const userRole = req.user.role;

if (!allowedRoles.includes(userRole)) {

return res.status(403).json({ message: 'Access denied' });

}

next();

};

}

// Example: only admins can access this route

app.get('/admin/dashboard', authorizeRoles('admin'), (req, res) => {

res.send('Admin Dashboard');

});

4️⃣ Secure Routes in Angular with Guards

On the frontend, use Angular’s route guards to improve user experience by preventing unauthorized navigation. The guard checks the user’s role before allowing access to certain routes:

canActivate(): boolean {

const userRole = localStorage.getItem('role');

if (userRole === 'admin') return true;

this.router.navigate(['/unauthorized']);

return false;

}

Although Angular guards restrict the UI, never rely on frontend checks for security—always validate roles on the backend.

5️⃣ Benefits of Role-Based Authentication

✅ Ensures sensitive features are protected

✅ Provides a scalable way to manage user permissions

✅ Improves user experience by showing relevant content

✅ Strengthens application security

🚀 Conclusion

Role-based authentication in the MEAN stack gives you precise control over who can do what in your app. By combining role definitions in MongoDB, JWT-based authentication in Node/Express, and route guards in Angular, you can build a secure and professional-grade web application.

Learn MEAN Stack Training Course

MongoDB Aggregation Framework for Beginners

MEAN Stack Interview Questions and Answers

Building a Blog App Using MEAN Stack

Creating a Chat Application with MEAN Stack

Visit Quality Thought Training Institute
Get Direction