Attribute based access control for Node.js.
Last updated 6 years ago by vovantics .
MIT · Repository · Bugs · Original npm · Tarball · package.json
$ cnpm install abac 
SYNC missed versions from official npm registry.


ABAC (Attribute Based Access Control) is a node.js package for providing a Connect/Express middleware that can be used to enable ABAC with various options.

Install (via npm)

$ npm install abac


Configure policies

Access control logic is defined using policies.

var express = require('express'),
    abac = require('abac');

abac.set_policy('in-memory', 'invite a friend', true);
abac.set_policy('in-memory', 'use secret feature', function(req) {
    if (req.user.role == 'employee') { return true; }
    return false;

Authorize requests

Use abac.can(backend, action, options), where backend is the name (i.e. 'in-memory') of the BackEnd used, action is the name of the action, and options are the optional parameters. If a policy is not defined, access control is denied by default.


If the request can perform the action (Permit), the next() callback is called. If the request cannot perform the action (Deny) or if the policy is undefined (Not Applicable), the middleware calls res.send(405) to return a HTTP 405 Method. If an error occurs (Indeterminate), the middleware signals an error by passing it as the first argument to next.

var express = require('express'),
    abac = require('abac');

app.post('/users/invite/', abac.can('in-memory', 'invite a friend'), function(req, res, next){
    res.json({msg: 'You sent an invite b/c you could!'});

Control flow

Pass yes() and no() callback functions in the options parameter. yes() gets fired if the request can perform the action (Permit). no() gets fired if the request cannot perform the action (Deny) or if an error has occurred (Indeterminate) or if the policy is not defined (Not Applicable).

var express = require('express'),
    abac = require('abac');

app.get('/', function(req, res, next){
    abac.can('in-memory', 'use secret feature', {
        yes: function() {
            // You're in!
        no: function(err, info) {
            // Sorry!
    })(req, res);

Serialize policies into permissions

Use abac.serialize(callback) to serialize all policies into a permissions Javascript object. The callback function has 2 arguments: (err, permissions). In the permissions Javascript object, the key is a policy's action and the value is the policy's rules evaluated as a boolean. This is useful for appling the same core logic to presentation and server-side access control decisions.

function get('/session/', function(req, res, next) {
    abac.serialize(function(err, permissions) {
        if (err) { next(err); }
        else {
            res.send(200, permissions);
    })(req, res);


$ npm install
$ make test


Thank you to jaredhanson's passport authentication middleware, which served as an excellent reference for designing a pluggable middleware interface.


MIT License


Stevo (stephenvovan@gmail.com)

Current Tags

  • 0.0.0                                ...           latest (6 years ago)

1 Versions

  • 0.0.0                                ...           6 years ago
Maintainers (1)
Today 0
This Week 0
This Month 0
Last Day 0
Last Week 0
Last Month 0
Dependencies (4)
Dev Dependencies (2)
Dependents (1)

Copyright 2014 - 2017 © taobao.org |