下面是我的一个项目中的一些基本身份验证代码。我使用它来对付CouchDB和额外的认证数据缓存，但我剥离了这些代码。

在请求处理周围包装一个身份验证方法，并为身份验证不成功提供第二个回调。成功回调将获得用户名作为附加参数。不要忘记在失败回调中正确处理错误或缺少凭据的请求:

/**
 * Authenticate a request against this authentication instance.
 * 
 * @param request
 * @param failureCallback
 * @param successCallback
 * @return
 */
Auth.prototype.authenticate = function(request, failureCallback, successCallback)
{
    var requestUsername = "";
    var requestPassword = "";
    if (!request.headers['authorization'])
    {
        failureCallback();
    }
    else
    {
        var auth = this._decodeBase64(request.headers['authorization']);
        if (auth)
        {
            requestUsername = auth.username;
            requestPassword = auth.password;
        }
        else
        {
            failureCallback();
        }
    }


    //TODO: Query your database (don't forget to do so async)


    db.query( function(result)
    {
        if (result.username == requestUsername && result.password == requestPassword)
        {
            successCallback(requestUsername);
        }
        else
        {
            failureCallback();
        }
    });

};


/**
 * Internal method for extracting username and password out of a Basic
 * Authentication header field.
 * 
 * @param headerValue
 * @return
 */
Auth.prototype._decodeBase64 = function(headerValue)
{
    var value;
    if (value = headerValue.match("^Basic\\s([A-Za-z0-9+/=]+)$"))
    {
        var auth = (new Buffer(value[1] || "", "base64")).toString("ascii");
        return {
            username : auth.slice(0, auth.indexOf(':')),
            password : auth.slice(auth.indexOf(':') + 1, auth.length)
        };
    }
    else
    {
        return null;
    }

};

对身份验证的另一种理解是passdless，这是express的一个基于令牌的身份验证模块，它绕过了密码[1]的固有问题。它实现起来很快，不需要太多表单，并且为普通用户提供了更好的安全性(完全披露:我是作者)。

[1]:密码过时

几年过去了，我想介绍我的Express身份验证解决方案。它叫做Lockit。你可以在GitHub上找到这个项目，也可以在我的博客上找到一个简短的介绍。

那么与现有的解决方案有什么不同呢?

easy to use: set up your DB, npm install, require('lockit'), lockit(app), done routes already built-in (/signup, /login, /forgot-password, etc.) views already built-in (based on Bootstrap but you can easily use your own views) it supports JSON communication for your AngularJS / Ember.js single page apps it does NOT support OAuth and OpenID. Only username and password. it works with several databases (CouchDB, MongoDB, SQL) out of the box it has tests (I couldn't find any tests for Drywall) it is actively maintained (compared to everyauth) email verification and forgot password process (send email with token, not supported by Passport) modularity: use only what you need flexibility: customize all the things

看一下这些例子。

如果您需要使用Microsoft Windows用户帐户进行SSO(单点登录)身份验证。你可以试试https://github.com/jlguenego/node-expose-sspi。

它会给你一个要求。Sso对象，其中包含所有客户端用户信息(登录名、显示名、sid、组)。

const express = require("express");
const { sso, sspi } = require("node-expose-sspi");

sso.config.debug = false;

const app = express();

app.use(sso.auth());

app.use((req, res, next) => {
  res.json({
    sso: req.sso
  });
});

app.listen(3000, () => console.log("Server started on port 3000"));

声明:我是node-expose-sspi的作者。

slim-auth

轻量级、零配置的用户认证模块。它不需要单独的数据库。

https://www.npmjs.com/package/slimauth

很简单:

app.get('/private-page', (req, res) => {

    if (req.user.isAuthorized) {
        // user is logged in! send the requested page
        // you can access req.user.email
    }
    else {
        // user not logged in. redirect to login page
    }
})

下面是一个使用时间戳令牌的新身份验证库。令牌可以通过电子邮件或短信发送给用户，而不需要将它们存储在数据库中。它可以用于无密码身份验证或双因素身份验证。

https://github.com/vote539/easy-no-password

披露:我是这个库的开发者。