测试（和对策）

Question

我想阻止用户直接输入页面的网址并进入页面。如何在节点中实现此功能？我知道在Web应用程序中将文件放在WEB-INF文件夹下会阻止直接访问它们。

Answer 1

如果您正在使用Express，您可以使用类似的内容检查中间件中的referer，您应该根据具体目的进一步调整：

var express = require('express')
var app = express()

permittedLinker = ['localhost', '127.0.0.1'];  // who can link here?

app.use(function(req, res, next) {
  var i=0, notFound=1, referer=req.get('Referer');

  if ((req.path==='/') || (req.path==='')) next(); // pass calls to '/' always

  if (referer){
      while ((i<permittedLinker.length) && notFound){
      notFound= (referer.indexOf(permittedLinker[i])===-1);
      i++;
      }
  }

  if (notFound) { 
     res.status(403).send('Protected area. Please enter website via www.mysite.com');
  } else {
    next(); // access is permitted, go to the next step in the ordinary routing
  }
});

app.get('/', function(req,res){
    res.send('<p>Hello.  You are at the main page. </p><a href="page2">page 2</a>');
});

app.get('/page2', function(req,res){
    res.send('<p>You are at page 2</p>');
});

app.listen(3000);  // test at http://localhost:3000

测试（和对策）

我们可以获得主页吗？的是

wget http://localhost:3000/

--2014-10-10 04:01:18--  http://localhost:3000/
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:3000... connected.
HTTP request sent, awaiting response... 
200 OK
Length: 67 [text/html]
Saving to: ‘index.html’

我们可以直接获得第二页吗？否

wget http://localhost:3000/page2 --2014-10-10 04:04:34-- http://localhost:3000/page2 Resolving localhost (localhost)... 127.0.0.1 Connecting to localhost (localhost)|127.0.0.1|:3000... connected. HTTP request sent, awaiting response... 403 Forbidden 2014-10-10 04:04:34 ERROR 403: Forbidden.

我们可以从第一页获得第二页吗？的是

wget --referer="http://localhost" http://localhost:3000/page2 --2014-10-10 04:05:32-- http://localhost:3000/page2 Resolving localhost (localhost)... 127.0.0.1 Connecting to localhost (localhost)|127.0.0.1|:3000... connected. HTTP request sent, awaiting response... 200 OK Length: 24 [text/html] Saving to: ‘page2’

任何脚本小子都可以学习使用wget --referer来击败这个＆＃34;保护＆＃34;方案？

是。它只会阻止诚实的人。不是真正想要内容的人。

阻止直接访问节点js中的html页面

1 个答案:

测试（和对策）