Using app.use(path, acl.middleware(0)) with different verbs causes last called verb to be reused about node_acl HOT 2 OPEN

You may have to pass the verb as the third parameter in your case.

acl.middleware(0, userId, 'post');

Let us know if this works.

from node_acl.

Just got bit by this. This makes use of the middleware without specifying a verb insecure.

The middleware is designed so that it will check the incoming verb against the user's permissions, which makes sense. But the bug described makes it such that one call to the middleware using GET will result in all future calls checking against GET instead of whatever the incoming verb is.

The fix suggested by @prabhu ignores the fact that the middleware is designed to check the incoming verb when one is not supplied, and I suspect this is the most common case.

Edited for unnecessarily strong language :)

from node_acl.