Question

有些问题：

Passport for Node.js（Express）的实现是否安全？
这是REST的正确实现吗？
- 我可以用这种方式在会话中存储状态吗？

/************************************
 *      Module dependencies.
 ************************************/

var express = require('express')
  , passport = require('passport')
  , BasicStrategy = require('passport-http').BasicStrategy

  , crypto = require('crypto')
  , http = require('http')
  , path = require('path')
  , fs = require('fs')

  , app = express()
  , service = require('./service');


var privateKey = fs.readFileSync('privatekey.pem').toString();
var certificate = fs.readFileSync('certificate.pem').toString();
var credentials = crypto.createCredentials({key: privateKey, cert: certificate});

/************************************
 *      Passport
 ************************************/

// User object supplied by MongoDB from the `service` object
// 
// {
//      id: 1,
//      password: 'otherTestPass',
//      salesmanId: 'A015',
//      email: 'otheruser@email.com'
// } 

passport.use(new BasicStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      if (!user.validPassword(password)) { return done(null, false); }
      return done(null, user);
    });
  }
));

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function(err, user) {
    done(err, user);
  });
});

/************************************
 *      Config
 ************************************/

// all environments
app.set('port', process.env.PORT || 8000);
app.set('views', __dirname + '/views');
app.set('view engine', 'jade');

app.use(express.favicon());
app.use(express.logger('dev'));
app.use(express.cookieParser());
app.use(express.bodyParser());

app.use(express.session({ secret: 'keyboard cat' })); // would normally have a randomly generated string
app.use(passport.initialize());
app.use(passport.session());
app.use(passport.authenticate('basic', {session: true}));

app.use(express.compress());
app.use(app.router);
app.use(express.static(path.join(__dirname, 'dist'))); // backbone SPA that talks to the '/api/' routes

// development only
if ('development' == app.get('env')) {
  app.use(express.errorHandler());
}



/************************************
 *      Routes
 ************************************/

app.get('/api/session/user', function(req,res){
    var user = req.user;
    delete user.password;
    res.json(user);
});

app.get('/api/customers', function(req,res){
    service.findAllCustomersBySalesmanId(req.user.salesmanId, function(result){
        res.json(result);
    });
});

app.get('/api/products', function(req,res){
    service.findAllProducts(function(result){
        res.json(result);
    });
});

app.get('/api/orders', function(req,res){
    service.findAllOrders(function(result){
        res.json(result);
    });
});

// ... other routes


/************************************
 *      Server Start
 ************************************/

http.createServer(app)
    .setSecure(credentials)
    .listen(app.get('port'), function(){
        console.log('Express server listening on port ' + app.get('port'));
    }
);

任何可以建议的人都可以获得额外的荣誉：

将api路由移动到另一个文件并将其“挂载”在/api/作为中间件配置的一部分的好方法。
通过检查是否允许用户执行某项操作来内部保护应用程序。

这个Node（Express）实现是否安全？

0 个答案: