Question

对于管理员用户：

$ curl -X POST localhost:5984/_session -d "username=admin&password=admin"  
{"ok":true,"name":"admin","roles":["_admin"]}  
$ curl -vX GET localhost:5984/_session --cookie AuthSession=YWRtaW...  
{"ok":true,"userCtx":{"name":"admin","roles":["_admin"]},"info":{"authentication_db":"_users","authentication_handlers":["cookie","default"],"authenticated":"cookie"}}

但对于普通用户：

$ curl -vX POST localhost:5984/_session -d "username=user&password=123"
{"ok":true,"name":"user","roles":["users"]}  
$  curl -vX GET localhost:5984/_session --cookie AuthSession=ZGlqbzo...  
{"ok":true,"userCtx":{"name":null,"roles":[]},"info":{"authentication_db":"_users","authentication_handlers":["cookie","default"]}}

当我通过iron-ajax元素执行XmlHttpRequest时，或者仅仅通过chrome执行相同的操作。我究竟做错了什么？

CouchDB版本：2.1.1
配置：

[chttpd]
  bind_address = 0.0.0.0
  port = 5984
  authentication_handlers = {couch_httpd_auth, cookie_authentication_handler}, {couch_httpd_auth, default_authentication_handler}
[httpd]
  enable_cors = true
[couch_httpd_auth]
  allow_persistent_cookies = true
  timeout = 60000
[cors]
  credentials = true
  origins = *
  headers = accept, authorization, content-type, origin, referer
  methods = GET, PUT, POST, HEAD, DELETE

Answer 1

我没有完全解决您的问题，但我在curl处使用Cookie作为非管理员用户进行身份验证：

首先，我使用-v选项运行curl以查看标题字段：

$ curl -k -v -X POST https://192.168.1.106:6984/_session -d 'username=jan&password=****'
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 192.168.1.106...
* Connected to 192.168.1.106 (192.168.1.106) port 6984 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 604 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
*    server certificate verification SKIPPED
*    server certificate status verification SKIPPED
* error fetching CN from cert:The requested data were not available.
*    common name:  (does not match '192.168.1.106')
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: O=Tech Studio
*    start date: Sat, 31 Mar 2018 04:37:51 GMT
*    expire date: Tue, 30 Mar 2021 04:37:51 GMT
*    issuer: O=Tech Studio
*    compression: NULL
* ALPN, server did not agree to a protocol
> POST /_session HTTP/1.1
> Host: 192.168.1.106:6984
> User-Agent: curl/7.47.0
> Accept: */*
> Content-Length: 25
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 25 out of 25 bytes
< HTTP/1.1 200 OK
< Set-Cookie: AuthSession=amFuOjVBRTk3MENGOuKAb68qYzf5jJ7bIOq72Jlfw-Qb; Version=1; Secure; Path=/; HttpOnly
< Server: CouchDB/2.1.1 (Erlang OTP/18)
< Date: Wed, 02 May 2018 08:03:27 GMT
< Content-Type: application/json
< Content-Length: 44
< Cache-Control: must-revalidate
< 
{"ok":true,"name":"jan","roles":["sample"]}
* Connection #0 to host 192.168.1.106 left intact

我在上面的标题字段中看到了cookie：

Set-Cookie: AuthSession=amFuOjVBRTk3MENGOuKAb68qYzf5jJ7bIOq72Jlfw-Qb; Version=1; Secure; Path=/; HttpOnly

我使用上述Cookie作为非管理员用户进行身份验证，并获取相同非管理员用户的用户信息，如下所示：

$ curl -k -X GET https://192.168.1.106:6984/_users/org.couchdb.user:jan -H 'Cookie: AuthSession=amFuOjVBRTk3MENGOuKAb68qYzf5jJ7bIOq72Jlfw-Qb'
{"_id":"org.couchdb.user:jan","_rev":"3-f11b227a6e1236fa502af668fdbf326d","name":"jan","roles":["sample"],"type":"user","password_scheme":"pbkdf2","iterations":10,"derived_key":"a973123ebd9dbc2a543d477a506268b018e7aab4","salt":"0ef2111a894062b08ffd723fd34b6b75"}

Answer 2

当我从local.ini

中删除时，问题就消失了

authentication_handlers = {couch_httpd_auth, cookie_authentication_handler}, {couch_httpd_auth, default_authentication_handler}

因为我在couch_httpd_auth的配置中使用了错误的处理程序：chttpd，当该处理程序只编写为与原始couch_httpd模块一起使用时

CouchDB无法为nonadmin用户获取cookie auth会话

2 个答案: