Case study · 2025
Book Review API
REST API with JWT sessions and per-user review ownership
A RESTful book-shop API on Node.js and Express. Anyone can browse the catalogue and read reviews; registered customers authenticate with JWT and can add, edit or delete only their own reviews.
- Context
- Course project · IBM back-end development with Node.js
- Year
- 2025
Overview
Public routes list the catalogue and look books up by ISBN, author or title. Customer routes under /customer/auth sit behind middleware that reads the JWT from the session, verifies it and attaches the username to the request, so the review routes can check ownership before any write.
Submitting a review for a book you have already reviewed updates it rather than creating a duplicate, and deleting is limited to your own reviews.
Key features
- Public catalogue routes by ISBN, author and title
- JWT stored in the session and verified by middleware
- Ownership checks before a review is edited or deleted
Architecture
Public routes
Catalogue lookups by ISBN, author and title
Auth middleware
Verifies the session's JWT and attaches the user
Customer routes
Add, update and delete only your own reviews
- Node.js
- Express
- JWT
- express-session