限制登录访问 - Passport.js,Google身份验证

Question

好的,所以使用passport.js可以正常工作,而且效果很好,从我所见过的.但是,我不确定如何正确排除某些用户.如果应用程序旨在限制访问,而不是仅仅为用户提供登录方法,我如何通过passport.js限制登录？目前,用户只需访问/login并使用他们的Google帐户登录,即可访问内部.

Answer 1

这是一种方法,整个评论.主要的是从作者那里理解这个页面:http://passportjs.org/guide/authenticate/,我在这个例子中解释了一下......

从下到上阅读可能更容易:

var authenticate = function(req, success, failure) {

    // Use the Google strategy with passport.js, but with a custom callback.
    // passport.authenticate returns Connect middleware that we will use below.
    //
    // For reference: http://passportjs.org/guide/authenticate/
    return passport.authenticate('google', 
        // This is the 'custom callback' part
        function (err, user, info) {

            if (err) { 
                failure(err);
            }
            else if (!user) { 
                failure("Invalid login data");
            }
            else {
                // Here, you can do what you want to control 
                // access. For example, you asked to deny users 
                // with a specific email address:
                if (user.emails[0].value === "no@emails.com") {
                    failure("User not allowed");
                }
                else {
                    // req.login is added by the passport.initialize() 
                    // middleware to manage login state. We need 
                    // to call it directly, as we're overriding
                    // the default passport behavior.
                    req.login(user, function(err) {
                        if (err) { 
                            failure(err);
                        }
                        success();
                    });
                }
            }
        }
    );
};

一个想法是将上面的代码包装在更多的中间件中,以便更容易阅读:

// This defines what we send back to clients that want to authenticate
// with the system.
var authMiddleware = function(req, res, next) {

    var success = function() {
        res.send(200, "Login successul");
    };

    var failure = function(error) {
        console.log(error);
        res.send(401, "Unauthorized"); 
    };

    var middleware = authenticate(req, success, failure);
    middleware(req, res, next);
};


// GET /auth/google/return
//   Use custom middleware to handle the return from Google.
//   The first /auth/google call can remain the same.
app.get('/auth/google/return', authMiddleware);

(这都假设我们正在使用Express.)