Question

所以我在使用Passport时遇到了问题，因为Passport支持其他类型（例如Google和GitHub），所以我一直试图摆脱原来的身份验证方法。我正在尝试实施本地身份验证，即使在查找了很多文章之后，它们似乎也不起作用。

这是代码的顶部：

const cookieExpirationDate = new Date();
cookieExpirationDate.setDate(cookieExpirationDate.getDate() + 7);

app.use(session({
    secret: secret_key,
    store: sessionStore,
    resave: true,
    saveUninitialized: true,
    cookie: {
        httpOnly: true,
        sameSite: 'strict',
        expires: cookieExpirationDate
    }
}));

// PASSPORT //
app.use(passport.initialize());
app.use(passport.session());

passport.use('local', new LocalStrategy({

        usernameField: 'username',

        passwordField: 'password',

        passReqToCallback: true //passback entire req to call back
    }, async function (req, username, password, done) {


        if (!username || !password) {
            return done(null, false, {message: 'Please complete the form!'})
        }
        const reqBody = {
            response: req.body['h-captcha-response'],
            secret: captcha_key
        }
        let axiosResult = await axios.post('https://hcaptcha.com/siteverify', qs.stringify(reqBody), {
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            }
        })
        if (axiosResult.data.success === true) {
            let results = await runQuery('SELECT * FROM accounts WHERE (username = ? OR email = ?)', [username, username])
            const forwarded = req.headers['x-forwarded-for']
            const ip = forwarded ? forwarded.split(/, /)[0] : req.connection.remoteAddress

            if (!results.length) {
                let amtLeft = await loginAttempts(ip);
                if (amtLeft > 1) {
                    return done(null, false, {message: `Incorrect Username and/or Password! (${amtLeft} attempt(s) left)`});
                } else {
                    return done(null, false, {message: `You must wait 15 minutes before trying again!`});
                }
            }
            let user = results[0]
            let isMatch = await bcrypt.compareSync(password, user.password)
            if (!isMatch) {
                let amtLeft = await loginAttempts(ip);
                if (amtLeft > 1) {
                    return done(null, false, {message: `Incorrect Username and/or Password! (${amtLeft} attempt(s) left)`});
                } else {
                    return done(null, false, {message: `You must wait 15 minutes before trying again!`});
                }
            } else {
                if (user.activation_code === "activated") {
                    return done(null, user)
                } else {
                    return done(null, false, {message: 'Check your email for an activation email!'})
                }
            }
        } else {
            return done(null, false, {message: `You must complete the captcha!`});
        }
    }
));

passport.serializeUser(function (user, done) {
    done(null, user.id);
});

passport.deserializeUser(async function (usrid, done) {
    let results = await runQuery('SELECT * FROM accounts WHERE id = ?', usrid)
    done(results[0]);
});

登录API部分：

app.post('/login_sys', regularFunctions, function (req, res, next) {
    passport.authenticate('local', {failWithError: true}, function (error, user, info) {
        if (error) {
            return res.status(500).json(error);
        }
        if (!user) {
            return res.status(401).json(info);
        }
        return res.status(200).send('Success')
    })(req, res, next);
})

regularFunctions：

let regularFunctions = [
    bodyParser.urlencoded({extended: true}),
    bodyParser.json(),
    function (req, res, next) {
        console.log('Authenticated: ' + req.isAuthenticated())
        if (req.isAuthenticated()) {
            req.session.loggedin = true;
            return next();
        } else {
            req.session.loggedin = false;
            return next();
        }
    }
]

如果它失败或成功，我需要它向客户端返回某种通知，因为我弹出了一个小窗口，让他们知道如果可行，它们将被重定向并通知他们剩下的尝试。问题是它可以正常工作并说它已登录，但是当我刷新页面时却没成功。

Answer 1

好一会儿才找到答案，我不得不在login_sys路由内使用req.login。

护照isAuthenticated（）始终返回false吗？

1 个答案: