Question

我已成功登录，但是，当我尝试访问仅经过身份验证的路由时，却未获授权。我不明白我在这里做错了什么，它成功登录并返回用户，我错在哪里？

这是我的代码：

这里基本上就是后端的服务器配置。

server.js

const express = require('express');
const mongoose = require('mongoose');
const bodyParser = require('body-parser');
const cors = require('cors')
const passport = require('passport')

// passport

const cookieParser = require('cookie-parser')
const session = require('cookie-session')
const { COOKIE_NAME } = require('./client/src/common/config')


const app = express();

// Bodyparser Middleware
app.use(bodyParser.json());

// DB Config

const db = require ('./config/keys').mongoURI;

// Connect to MongoDB

mongoose
    .connect(db, {useNewUrlParser: true, useUnifiedTopology: true, useFindAndModify: false})
    .then(() => console.log('Mongo DB Connected...'))
    .catch(err => console.log(err));



// CORS

app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
  });

const secret = process.env.APP_SECRET
const env = process.env.NODE_ENV || 'development'
const isLocal = env === 'development'
/* Session Setup */
app.use(cookieParser()) // read cookies (needed for auth)
if (!isLocal) {
  app.set('trust proxy', 1)
}
app.use(
  session({
    httpOnly: false,
    name: COOKIE_NAME,
    keys: [secret],
    secure: !isLocal,
    maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
  })
)

/* Session management with Passport */
require('./passport')(passport)
app.use(passport.initialize())
app.use(passport.session())

// Register Schema
require('./models/User')

// Insert some default users
// require('./config/_insertDefaultUsers')

const patients = require('./routes/api/patients');
const auth = require('./routes/api/auth');
const drugs = require('./routes/api/drugs');
const trainees = require('./routes/api/trainees')

// Use Routes

app.use('/api/patients', patients);
app.use('/api/drugs', drugs);
app.use('/api/trainees', trainees)
app.use('/api/auth', auth);
app.use(cors())

// Connect to deployment port or localhost

const port = process.env.PORT || 5000;

app.listen(port, () => console.log(`Server started on port ${port}`));

access.js 这是一个用于检查身份验证的基本中间件，因此我可以将其添加到我的路由中

const ROLES = require('.././client/src/common/roles')

/** Access middleware to ensure user is allowed to access certain routes */
const AccessMiddleware = {
  hasAccess: (req, res, next) => {
    if (!req.isAuthenticated()) {
      req.session.redirectTo = req.originalUrl
      return res.status(401).json({ success: false, error: 'unauthorized' })
    }

    next()
  },

  hasAdminAccess: (req, res, next) => {
    if (!req.isAuthenticated() || req.user.role !== ROLES.ADMIN) {
      req.session.redirectTo = req.originalUrl
      return res.status(401).json({ success: false, error: 'unauthorized' })
    }

    next()
  },
}

module.exports = AccessMiddleware

auth.js 路由，这基本上是允许我登录等的身份验证 API

const express = require('express');
const router = express.Router();
const passport = require('passport')
const AccessMiddleware = require('../../config/access')


const errorResponse = (res, error) => {
  res.status(400).json({ success: false, error })
}

router.get('/test', (req, res) => {
  res.json({ success: true, message: 'Test API route working fine!' })
})

router.get('/authenticated-only', AccessMiddleware.hasAccess, (req, res) => {
  res.json({ success: true, message: 'You have auth access!' })
})

router.get('/admin-only', AccessMiddleware.hasAdminAccess, (req, res) => {
  res.json({ success: true, message: 'You have admin access!' })
})

router.post('/login', (req, res, next) => {
  const { email, password } = req.body
  if (!email || !password) {
    return errorResponse(res, 'Invalid credentials')
  }

  // Authenticate the user using the credentials provided
  passport.authenticate('local', { session: true }, function (err, user) {
    if (err) {
      return errorResponse(res, 'Invalid credentials')
    }

    // When using passport with callback, we have to manually call req.login to set the Cookie
    req.login(user, async () => {
      res.json({ success: true, user })
    })
  })(req, res, next)
})

module.exports = router
exports.errorResponse = errorResponse

Answer 1

对于任何寻求解决方案的人：

const secret = "secrethere"
app.use(cookieParser("secrethere"))

问题似乎是我没有在服务器文件中使用相同的秘密。

登录时未经授权？

1 个答案: