Authorization determines what an authenticated user is allowed to do. On every request, the server checks that the resource belongs to them or that their role permits it, otherwise it responds 403, or 404 so as not to reveal its existence. An identifier supplied by the client is never enough as proof.
Example
if (note.userId !== req.user.id) return res.sendStatus(403);