Suppose I have two users, A and B.   

A is allowed to access all the resources available, but B can access them only partially.  

What is the proper way to prevent B from accessing resources to which B does not have permission?

Should I create some sort of whitelist that specifies only URLs B can access?

The following snippet is what I currently have.
It is a middleware which checks whether each request is allowed to access specific URLs.

```
const ALLOWED_URLS = ['api/resource1', 'api/resource2', 'api/resource3'];
const sessionCheck = (req, res, next) => {
   const url = req.originalUrl;
   // check whether accessing URL is allowed
}

```

Is there any better approach than this?