Question

我正在尝试使用express，sequelize和mysql实现NodeJS身份验证，但我被阻止了。我通过webservice获取登录名和密码值。我想将它们与数据库值匹配：

app.get('/login', function (req, res, err) {           
    var whereUser = {
        login: req.query.login,
        password: req.query.password
    }      

    if (!req.query.login || !req.query.password) {
        res.send('login failed');
//Here my code is wrong ! 
I try to compare login and password values with database login and passwword values          
            } else if (req.query.login && req.query.password == UsrPerson.findOne({ where: whereUser })) {        
                console.log("auth ok")
                req.session.user = "amy";
                req.session.admin = true;        
                res.send("login success!");
            } else {
                console.log("ERROR")
                res.send(err)
            }
        });

我该怎么做？谢谢

Answer 1

app.get('/login', function (req, res, err) {    
  const { login, password } = req.query;

  UsrPerson
    .findOne({
      where: {
        login: login,
        password: password
      }
    })
    .then((foundUser) => {
      if(!foundUser){
        res.send('login failed');
      } else {
        console.log("auth ok");
        req.session.user = "amy";
        req.session.admin = true;
        res.send("login success!");
      }
    })
    .catch((err) => {
      console.log('ERROR');
      res.send(err);
    });
});

您想要比较具有给定用户名和密码组合的用户是否存在。

似乎您在没有任何加密的情况下以纯文本格式存储密码。这根本不安全。您必须使用bcrypt之类的库，并且只将加密的密码存储在数据库中

Answer 2

sequelize的findOne方法返回模型的实例对象。这意味着您可以将password与实例进行比较。

第二个问题是findOne方法是异步的，您需要await它并拥有async方法。

app.get('/login', async function (req, res, err) {           
    var whereUser = {
        login: req.query.login,
        password: req.query.password
    }      

   if (!req.query.login || !req.query.password) {
       res.send('login failed');
    } else {        
        // The following code return an instance of the user if it was found.
       const user = await UsrPerson.findOne({ where: whereUser }))

       // If the user was not found that means the credentials was wrong.
       if (user) {
           console.log("auth ok")
           req.session.user = "amy";
           req.session.admin = true;        
           res.send("login success!");
       } else {
           console.log("ERROR")
           res.send(err)
       }
   } 
});

认证NodeJS Sequelize Express

2 个答案: