uniquejava
commented
7 years ago 关于flash message
cyper实战一, 定义 passport.local.js:
var passport = require('passport');
var fs = require('fs');
var path = require('path');
var _ = require('underscore');
var LocalStrategy = require('passport-local').Strategy;
passport.use(new LocalStrategy({
usernameField: 'username',
passwordField: 'password',
passReqToCallback: true
},
function (req, username, password, done) {
fs.readFile(path.join(__dirname, './data/users.json'), 'utf8', function (err, doc) {
if (err) {
return done(err);
}
var doc = JSON.parse(doc);
var user = _.findWhere(doc, {username: username});
if (!user) {
req.flash("field", "username");
req.flash("message", "Incorrect username.");
return done(null, false);
}
if (user.password !== password) {
req.flash("field", "password");
req.flash("message", "Incorrect password.");
return done(null, false);
}
return done(null, username);
});
}
));
passport.serializeUser(function (user, done) {
done(null, user);
});
passport.deserializeUser(function (user, done) {
done(null, user);
});
module.exports = passport;
使用indexRoutes.js
router.get('/login', function (req, res, next) {
var fields = req.flash('field');
var messages = req.flash('message');
res.render('login', {field: fields[0], message: messages[0]});
});
router.post('/login', passport.authenticate('local', {
failureRedirect: '/login',
failureFlash: true /* <=== 这里改成false也不影响. */
}), function (req, res) {
var user = req.user;
console.log(user + ' logged in.');
req.session.user = user;
res.cookie('token', someToken);
res.redirect(user === 'admin' ? '/admin' : '/xxxx');
});页面 login.ejs
function login() {
var rules = {
username: {
identifier: "username",
rules: [{type: 'empty'}]
},
password: {
identifier: "password",
rules: [{type: 'empty'}]
},
};
var form = $('.login-form').form({fields: rules});
form.form("validate form");
var isValid = form.form('is valid');
if (isValid) {
createCookie('username', $('#username').val());
createCookie('remember', $('.ui.checkbox').checkbox('is checked'));
$(this).prop("disabled", true).toggleClass("loading", true);
form.form('submit');
}
}
$(document).ready(function () {
// remember me
var remember = getCookie('remember');
if (remember === 'false') {
$('#username').val('');
$('.ui.checkbox').checkbox('uncheck');
} else {
$('#username').val(getCookie('username'));
$('.ui.checkbox').checkbox('check');
}
// display error message if exist
var field = '<%= field %>';
var message = '<%= message %>';
if (field) {
$('#username').val(getCookie('username'));
var form = $('.login-form').form({inline: true});
form.form('add prompt', field, message);
}
// handle text input key up event
$('#username').keyup(function (event) {
if (event.keyCode === 13) {
$('#password').focus();
}
});
$('#password').keyup(function (event) {
if (event.keyCode === 13) {
login();
}
});
$('#btnSubmit').click(login);
});登出 xxxRoutes.js
router.get('/logout', function (req, res, next) {
// see https://stackoverflow.com/questions/33332614/either-req-logout-or-req-session-destroy-does-not-work
// see https://github.com/jaredhanson/passport/issues/246
req.session.destroy(function () {
req.logout();
console.log("user session destroyed.");
console.log(req.isAuthenticated());
res.redirect('/login');
});
});
为什么要调用logout, 解释如下
req.isAuthenticated() is part of passport. Relevant code:
req.isAuthenticated = function() {
var property = 'user';
if (this._passport && this._passport.instance._userProperty) {
property = this._passport.instance._userProperty;
}
return (this[property]) ? true : false;
};Checks for the property and returns a boolean.
req.logout() removes the property so it returns false in future requests.
Meanwhile, session.destroy comes from expressjs/session middleware, so it's not passport related. Maybe you are creating the session again in the index page. The question needs more info.
这里是最详尽的文档: http://passportjs.org/docs/authenticate 上面的文档对flash message的叙述有误 见Node.js Authentification with Passport: How to flash a message if a field is missing?
其中有提到这篇博客: https://scotch.io/tutorials/easy-node-authentication-setup-and-local 写得非常详细.
Quick start
要快速开始可以看github page首页上的express 4 demo, 按我的理解快速记下几个要点:
passport只用在login的那一刻, 也就是说, 有且只用在一个地方.
在其它地方可以使用
req.isAuthenticated()来判断用户是否登录了, 但我们一般都会把user放在session里, 然后判断req.session.user是否存在, 所以这个isAuthenticated方法不是很有必要.要使用上面的代码能正常运行, 需要向passport注册一些Strategy(目前有300多种strategy可用), 官网首页上有个列表, qq, weibo, weixin, twitter, facebook你能想到的都在里边.
这个strategy name默认叫'local', 就是常用的用form表单提交用户密码的情况. 以下是配置部分, 用代码说话:
Strategies 注册Strategy
Sessions 序列化与反序列化
Middleware 依赖的组件
Authenticate Requests 仅用在登录处
也可以这样
References
http://passportjs.org/
https://github.com/jaredhanson/passport
使用passportjs进行登录验证
使用 passport.js 完成后台验证