slim-auth

轻量级、零配置的用户认证模块。它不需要单独的数据库。

https://www.npmjs.com/package/slimauth

很简单:

app.get('/private-page', (req, res) => {

    if (req.user.isAuthorized) {
        // user is logged in! send the requested page
        // you can access req.user.email
    }
    else {
        // user not logged in. redirect to login page
    }
})

下面是我的一个项目中的一些基本身份验证代码。我使用它来对付CouchDB和额外的认证数据缓存，但我剥离了这些代码。

在请求处理周围包装一个身份验证方法，并为身份验证不成功提供第二个回调。成功回调将获得用户名作为附加参数。不要忘记在失败回调中正确处理错误或缺少凭据的请求:

/**
 * Authenticate a request against this authentication instance.
 * 
 * @param request
 * @param failureCallback
 * @param successCallback
 * @return
 */
Auth.prototype.authenticate = function(request, failureCallback, successCallback)
{
    var requestUsername = "";
    var requestPassword = "";
    if (!request.headers['authorization'])
    {
        failureCallback();
    }
    else
    {
        var auth = this._decodeBase64(request.headers['authorization']);
        if (auth)
        {
            requestUsername = auth.username;
            requestPassword = auth.password;
        }
        else
        {
            failureCallback();
        }
    }


    //TODO: Query your database (don't forget to do so async)


    db.query( function(result)
    {
        if (result.username == requestUsername && result.password == requestPassword)
        {
            successCallback(requestUsername);
        }
        else
        {
            failureCallback();
        }
    });

};


/**
 * Internal method for extracting username and password out of a Basic
 * Authentication header field.
 * 
 * @param headerValue
 * @return
 */
Auth.prototype._decodeBase64 = function(headerValue)
{
    var value;
    if (value = headerValue.match("^Basic\\s([A-Za-z0-9+/=]+)$"))
    {
        var auth = (new Buffer(value[1] || "", "base64")).toString("ascii");
        return {
            username : auth.slice(0, auth.indexOf(':')),
            password : auth.slice(auth.indexOf(':') + 1, auth.length)
        };
    }
    else
    {
        return null;
    }

};

看起来连接中间件的连接认证插件正是我所需要的

我使用的是express [http://expressjs.com]，所以连接插件非常适合，因为express是连接的子类(好吧-原型)

几年过去了，我想介绍我的Express身份验证解决方案。它叫做Lockit。你可以在GitHub上找到这个项目，也可以在我的博客上找到一个简短的介绍。

那么与现有的解决方案有什么不同呢?

easy to use: set up your DB, npm install, require('lockit'), lockit(app), done routes already built-in (/signup, /login, /forgot-password, etc.) views already built-in (based on Bootstrap but you can easily use your own views) it supports JSON communication for your AngularJS / Ember.js single page apps it does NOT support OAuth and OpenID. Only username and password. it works with several databases (CouchDB, MongoDB, SQL) out of the box it has tests (I couldn't find any tests for Drywall) it is actively maintained (compared to everyauth) email verification and forgot password process (send email with token, not supported by Passport) modularity: use only what you need flexibility: customize all the things

看一下这些例子。

会话+ If

我想，您没有找到很多好的库的原因是，使用库进行身份验证在很大程度上是过度设计的。

你要找的只是一个会话绑定器:)一个会话:

if login and user == xxx and pwd == xxx 
   then store an authenticated=true into the session 
if logout destroy session

这是它。

我不同意你认为connect-auth插件是正确的选择的结论。

我也使用连接，但我不使用连接认证的原因有两个:

IMHO打破了connect-auth非常强大且易于阅读的洋葱环架构。不去——我的观点:)。 你可以在这里找到一篇关于connect如何工作和洋葱圈想法的非常好的简短文章。 如果你——如前所述——只是想使用数据库或文件的基本或http登录。Connect-auth太大了。它更适合OAuth 1.0、OAuth 2.0等

使用connect进行非常简单的身份验证

(这是完整的。只是执行测试，但如果你想在生产中使用它，请确保使用https) (为了符合rest原则，你应该使用POST-Request而不是GET-Request b/c你改变了一个状态:)

var connect = require('connect');
var urlparser = require('url');

var authCheck = function (req, res, next) {
    url = req.urlp = urlparser.parse(req.url, true);

    // ####
    // Logout
    if ( url.pathname == "/logout" ) {
      req.session.destroy();
    }

    // ####
    // Is User already validated?
    if (req.session && req.session.auth == true) {
      next(); // stop here and pass to the next onion ring of connect
      return;
    }

    // ########
    // Auth - Replace this example with your Database, Auth-File or other things
    // If Database, you need a Async callback...
    if ( url.pathname == "/login" && 
         url.query.name == "max" && 
         url.query.pwd == "herewego"  ) {
      req.session.auth = true;
      next();
      return;
    }

    // ####
    // This user is not authorized. Stop talking to him.
    res.writeHead(403);
    res.end('Sorry you are not authorized.\n\nFor a login use: /login?name=max&pwd=herewego');
    return;
}

var helloWorldContent = function (req, res, next) {
    res.writeHead(200, { 'Content-Type': 'text/plain' });
    res.end('authorized. Walk around :) or use /logout to leave\n\nYou are currently at '+req.urlp.pathname);
}

var server = connect.createServer(
      connect.logger({ format: ':method :url' }),
      connect.cookieParser(),
      connect.session({ secret: 'foobar' }),
      connect.bodyParser(),
      authCheck,
      helloWorldContent
);

server.listen(3000);

NOTE

我在一年多前写了这个声明，目前没有活动节点项目。可能会有API-Changes in Express。如果我需要修改什么，请加上评论。

使用mongo的简单示例，用于为ie Angular客户端提供用户认证的API

在app.js

var express = require('express');
var MongoStore = require('connect-mongo')(express);

// ...

app.use(express.cookieParser());
// obviously change db settings to suit
app.use(express.session({
    secret: 'blah1234',
    store: new MongoStore({
        db: 'dbname',
        host: 'localhost',
        port: 27017
    })
}));

app.use(app.router);

对于你的路线是这样的:

// (mongo connection stuff)

exports.login = function(req, res) {

    var email = req.body.email;
    // use bcrypt in production for password hashing
    var password = req.body.password;

    db.collection('users', function(err, collection) {
        collection.findOne({'email': email, 'password': password}, function(err, user) {
            if (err) {
                res.send(500);
            } else {
                if(user !== null) {
                    req.session.user = user;
                    res.send(200);
                } else {
                    res.send(401);
                }
            }
        });
    });
};

然后在你需要认证的路由中，你可以检查用户会话:

if (!req.session.user) {
    res.send(403);
}