安全的方法來檢查身份驗證（NodeJS/Express）

Question

我想確保用戶通過身份驗證（當登錄用戶獲取會話時）。

function isAuthenticated(req, res, next) { 

    // do any checks you want to in here 

    // CHECK THE USER STORED IN SESSION FOR A CUSTOM VARIABLE 
    // you can do this however you want with whatever variables you set up 
    if (req.user.authenticated) 
     return next(); 

    // IF A USER ISN'T LOGGED IN, THEN REDIRECT THEM SOMEWHERE 
    res.redirect('/'); 
} 
app.get('/hello', isAuthenticated, function(req, res) { 
    res.send('look at me!'); 
}); 

是否有另一種（更安全）的方式來檢查用戶是否通過身份驗證？

Answer 1

使用express-session：

https://github.com/expressjs/session

Psudo代碼：

var expressSession = require('express-session'); 
app.use(expressSession({ secret: 'secret' })); 

//...// 
app.get('/',function(req,res){ 
    if (req.session.auth === undefined || req.session.auth === false){ 
     //handle by redirection to authentication page 
    } 
    //user is authenitcated 
});