The Authorization logic is wrong in 2 ways:

- not passing an id with the request does not make the request 'Unauthorized'
- authorization is the server's responsibility and should not be based on an id sent from a browser

axios.delete (as part of best practices with DELETE request) does not support passing a data based on the documentation API: https://axios-http.com/docs/api_intro

- pass the id in the url
- to check authorization, retrieve the user with the token and compare their id.

all HTTP DELETE requests to route handlers cannot contain body, req.json() inside a DELETE route won't work (last time I checked)