防止在Node.js和Passport.js中强行强制登录

Question

我创建了一个简单的登录身份验证，但是发现您可以通过键入“ http://localhost:8080/login?username=user2”来强制进行身份验证。我正试图阻止其他人访问彼此的帐户。

基本登录

app.post('/login', passport.authenticate('local-login', {
    successRedirect : '/profile', // redirect to the secure profile section
    failureRedirect : '/login', // redirect back to the signup page if there is an error
    failureFlash : true // allow flash messages
}));

基本的本地策略方法

passport.use('local-login', new LocalStrategy({
    // by default, local strategy uses username and password, we will override with username
    usernameField : 'username',
    passwordField : 'username',
    passReqToCallback : true // allows us to pass in the req from our route (lets us check if a user is logged in or not)
},
function(req, username, password, done) {
    if (username)
        username = username.toLowerCase(); // Use lower-case e-mails to avoid case-sensitive e-mail matching

// asynchronous
process.nextTick(function() {
    User.findOne({ 'local.username' :  username }, function(err, user) {
        // if there are any errors, return the error
        if (err)
            return done(err);

        // if no user is found, return the message
        if (!user)
            return done(null, false, req.flash('loginMessage', 'No user found.'));

        if (!user.validPassword(password))
            return done(null, false, req.flash('loginMessage', 'Oops! Wrong password.'));

        // all is well, return user
        else
            return done(null, user);
    });
});

}））;

防止这种情况的最佳方法是什么。谢谢