Question

我正在开发一个需要身份验证的简单node.js项目。我决定使用connect-redis进行会话，使用redis支持的数据库来存储用户登录数据。

以下是我目前设置的内容：

// Module Dependencies

var express = require('express');
var redis = require('redis');
var client = redis.createClient();
var RedisStore = require('connect-redis')(express);
var crypto = require('crypto');

var app = module.exports = express.createServer();  

// Configuration

app.configure(function(){
  app.set('views', __dirname + '/views');
  app.set('view engine', 'jade');
  app.use(express.bodyParser());
  app.use(express.methodOverride());
  app.use(express.cookieParser());
  app.use(express.session({ secret: 'obqc487yusyfcbjgahkwfet73asdlkfyuga9r3a4', store: new RedisStore }));
  app.use(require('stylus').middleware({ src: __dirname + '/public' }));
  app.use(app.router);
  app.use(express.static(__dirname + '/public'));
});

app.configure('development', function(){
  app.use(express.errorHandler({ dumpExceptions: true, showStack: true }));
});

app.configure('production', function(){
  app.use(express.errorHandler()); 
});

// Message Helper

app.dynamicHelpers({
  // Index Alerts
  indexMessage: function(req){
    var msg = req.sessionStore.indexMessage;
    if (msg) return '<p class="message">' + msg + '</p>';
  },
  // Login Alerts
  loginMessage: function(req){
    var err = req.sessionStore.loginError;
    var msg = req.sessionStore.loginSuccess;
    delete req.sessionStore.loginError;
    delete req.sessionStore.loginSuccess;
    if (err) return '<p class="error">' + err + '</p>';
    if (msg) return '<p class="success">' + msg + '</p>';
  },
  // Register Alerts
  registerMessage: function(req){
    var err = req.sessionStore.registerError;
    var msg = req.sessionStore.registerSuccess;
    delete req.sessionStore.registerError;
    delete req.sessionStore.registerSuccess;
    if (err) return '<p class="error">' + err + '</p>';
    if (msg) return '<p class="success">' + msg + '</p>';
  },
  // Session Access
  sessionStore: function(req, res){
    return req.sessionStore;
  }
});

// Salt Generator

function generateSalt(){
  var text = "";
  var possible= "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*"
  for(var i = 0; i < 40; i++)
    text += possible.charAt(Math.floor(Math.random() * possible.length));
  return text;
}

// Generate Hash

function hash(msg, key){
  return crypto.createHmac('sha256', key).update(msg).digest('hex');
}

// Authenticate

function authenticate(username, pass, fn){
  client.get('username:' + username + ':uid', function(err, reply){
    var uid = reply;
    client.get('uid:' + uid + ':pass', function(err, reply){
      var storedPass = reply;
      client.get('uid:' + uid + ':salt', function(err, reply){
        var storedSalt = reply;
        if (uid == null){
          return fn(new Error('cannot find user'));
        }
        if (storedPass == hash(pass, storedSalt)){
          client.get('uid:' + uid + ':name', function(err, reply){
            var name = reply;
            client.get('uid:' + uid + ':username', function(err, reply){
              var username = reply;
              var user = {
                name: name,
                username: username
              }
              return fn(null, user);
            });
          });
        }
      });
    });
  });
  fn(new Error('invalid password'));
}

function restrict(req, res, next){
  if (req.sessionStore.user) {
    next();
  } else {
    req.sessionStore.loginError = 'Access denied!';
    res.redirect('/login');
  }
}

function accessLogger(req, res, next) {
  console.log('/restricted accessed by %s', req.sessionStore.user.username);
  next();
}

// Routes

app.get('/', function(req, res){
  res.render('index', {
    title: 'TileTabs'
  });
});

app.get('/restricted', restrict, accessLogger, function(req, res){
  res.render('restricted', {
    title: 'Restricted Section'
  });
});

app.get('/logout', function(req, res){
  console.log(req.sessionStore.user.username + ' has logged out.');
  req.sessionStore.destroy(function(){
    res.redirect('home');
  });
});

app.get('/login', function(req, res){
  res.render('login', {
    title: 'TileTabs Login'
  });
});

app.post('/login', function(req, res){
  authenticate(req.body.username, req.body.password, function(err, user){
    if (user) {
      req.session.regenerate(function(){
        req.sessionStore.user = user;
        req.sessionStore.indexMessage = 'Authenticated as ' + req.sessionStore.user.name + '.  Click to <a href="/logout">logout</a>. ' + ' You may now access <a href="/restricted">the restricted section</a>.';
        res.redirect('home');
        console.log(req.sessionStore.user.username + ' logged in!');
      });
    } else {
      req.sessionStore.loginError = 'Authentication failed, please check your '
        + ' username and password.';
      res.redirect('back');
    }
  });
});

app.get('/register', function(req, res){
  res.render('register', {
    title: 'TileTabs Register'
  });
});

app.post('/register', function(req, res){
  var name = req.body.name;
  var username = req.body.username;
  var password = req.body.password;
  var salt = generateSalt();

  client.get('username:' + username + ':uid', function(err, reply){
    if (reply !== null){
      console.log(reply);
      req.sessionStore.registerError = 'Registration failed, ' + username + ' already taken.';
      res.redirect('back');
    }
    else{
      client.incr('global:nextUserId');
      client.get('global:nextUserId', function(err, reply){
        client.set('username:' + username + ':uid', reply);
        client.set('uid:' + reply + ':name', name);
        client.set('uid:' + reply + ':username', username);
        client.set('uid:' + reply + ':salt', salt);
        client.set('uid:' + reply + ':pass', hash(password, salt));
      });

      req.sessionStore.loginSuccess = 'Thanks for registering!  Try logging in!';
      console.log(username + ' has registered!');
      res.redirect('/login');
    }
  });
});

// Only listen on $ node app.js

if (!module.parent) {
  app.listen(80);
  console.log("Express server listening on port %d", app.address().port);
}

注册效果很好。但是，在使用正确的用户凭据登录时，我抛出以下错误：

node.js:134
        throw e; // process.nextTick error, or 'error' event on first tick
        ^
Error: Can't set headers after they are sent.

我已设法在res.redirect('home');中识别出引发此错误的行（app.post('/login')）。只是想知道，除了我写得不好的代码之外，我还需要做些什么来解决这个错误。

更新

版本：

节点0.4.10
表达2.4.3
npm 1.0.22
redis 2.4.0 rc5
连接1.6.0
connect-redis 1.0.6

以下是我的应用的链接：

http://dl.dropbox.com/u/4873115/TileTabs.zip

Answer 1

更新

问题是验证（）。以下我认为正确实施：

function authenticate(username, pass, fn){
  client.get('username:' + username + ':uid', function (err, reply) {
    var uid = reply;
    client.get('uid:' + uid + ':pass', function(err, reply){
      var storedPass = reply;
      client.get('uid:' + uid + ':salt', function(err, reply){
        var storedSalt = reply;
        if (uid == null){
          fn(new Error('cannot find user'));
          return;
        } else  if (storedPass == hash(pass, storedSalt)) {
          client.get('uid:' + uid + ':name', function(err, reply){
            var name = reply;
            client.get('uid:' + uid + ':username', function(err, reply){
              var username = reply;
              var user = {
                name: name,
                username: username
              }
              fn(null, user);
              return;
            });
          });
        } else {
            return fn(new Error('invalid password'));    
        }
      });
    });
  });
  //return fn(new Error('invalid password'));
}

我无法运行该示例，因为我没有您的手写笔文件。你不能归档你的项目并在这里发布，以便我们也可以运行你的代码。如果我的记忆对我有用，那么当您将旧模块与新模块结合使用时，可能会遇到这些问题。您安装了哪些版本的express，connect-redis，redis，connect等？

P.S：如果你上传，我不能立即运行你的代码，因为我必须上床睡觉，必须在早上工作。但希望其他人可以帮助你。或者也许是安装模块的问题。

Answer 2

我的猜测是req.sessionStore.destroy可能会发送一个“Set-Cookie”标头来过期/删除会话cookie，因为涉及到IO，节点有机会在{{1}之前发送HTTP响应标头代码运行，因此生成错误。尝试直接在res.redirect内部res.redirect而不是app.post回调内部，看看是否可以避免错误。

如果代码在发送后尝试读取标题，您可能也会点击this node.js bug。

Node.js在发送后无法设置标头

2 个答案:

更新