API to verify whether a Redis entry exists
if(typeof req.body.data !== 'undefined' &amp;&amp; req.body.data ...

// to

if(req.body.data &amp;&amp; req.query.hash &amp;&amp; typeof req.body.id)


Assuming that false, 0, null and an empty string has no special meaning in this program, you can simply use loose comparison. Anything falsy (null, undefined, false, 0, NaN, empty string) will just fall off.

function foo(bar){
  if(bar !== 'foo'){
    if(bar !== 'bas'){
      if(bar !== 'bam'){
        // ok, bar is what it is
      } else {
        throw new Error('not bar');
      }
    } else {
      throw new Error('not bar');
    }
  } else {
    throw new Error('not bar');
  }
}

// to

function foo(bar){
  // Expanded for emphasis. You can actually combine
  if(bar === 'foo') throw new Error('not bar');
  if(bar === 'bas') throw new Error('not bar');
  if(bar === 'bam') throw new Error('not bar');

  // ok, bar is what it is
}


Another approach to flattening conditionals is to "return early". Usually, when you have nested if statements, you can invert the condition and the code will look flat. But your mileage may vary, depending on your code.

Now for your errors, HTTP response numbers will cover that for you.


To start, 4xx errors mean the client did something wrong. On the other hand, 5xx errors means the server did something wrong.
A "wrong parameters type" means the client sent the wrong data. That's a 400 (Bad Request) and not a 403 (Forbidden).
A database error or a parse error should be a 500 (Internal Server Error). 
If the token does not exist or has the wrong id, that counts as a 401 (Unauthorized). The difference between 401 and 403 is that a 401 can be lifted if you are authenticated (ie. token exists, validation passes etc.) while 403 is more of a permanent unauthorized access.


With that, and removing the logging, this should be all that's left. Feel free to add back the brackets. I usually omit them if I deal with one-liner bodies.

http.checkParam = function CheckParam(req, cb) {
  if(!req.body.data || !req.query.hash || ! req.body.id) cb(400);
  else redis.get(req.query.hash, function(err, data) {
    if(err) cb(500);
    else if(!data) cb(401);
    else try {
      var obj = JSON.parse(data);
      if (obj.member.id !== req.body.id) cb(401);
      else cb(200);
    } catch(error){
      cb(500);
    }
  });
};