使用護照註冊後防止用戶身份驗證

Question

我已經使用護照和express.js設置了登錄/註冊界面和機制。我遇到的問題是，在用戶註冊後，我們被重定向到登錄頁面，但我們最終可以更改URL並立即在用戶配置文件中輸入，但這當然不是預期和想要的。我希望用戶在註冊後沒有通過身份驗證，並且他需要在登錄頁面中手動輸入他/她的憑據，然後才能輸入其個人資料。

router.get('/', isAuthenticated, function(req, res) { 

    res.render('library', { 
    // passing the id of and username the connecting user to the dust 
    userid: req.user._id, 
    username: req.user.userName 
    }); 
}); 

router.get('/library', isAuthenticated, function(req, res) { 
    res.render('library', { 
    // passing the id of and username the connecting user to the dust 
    userid: req.user._id, 
    username: req.user.userName 
    }); 
}); 

/* GET login page. */ 
router.get('/login', function(req, res) { 
    // Display the Login page with any flash message, if any 
    res.render('login', { 
    message: req.flash('message') 
    }); 
}); 

/* Handle Login POST 

password.authenticate is used to delegate the authentication 
to the login strategy when a HTTP POST is made to /login. 
*/ 
router.post('/login', passport.authenticate('login', { 
    successRedirect: '/library', 
    failureRedirect: '/', 
    failureFlash: true 
})); 

/* GET Registration Page */ 
router.get('/signup', function(req, res) { 
    res.render('signup', { 
    message: req.flash('message') 
    }); 
}); 
/* Handle Registration POST 

password.authenticate is used to delegate the authentication 
to the signup strategy when a HTTP POST is made to /signup. 
*/ 
router.post('/signup', passport.authenticate('signup', { 
    successRedirect: '/login', 
    failureRedirect: '/signup', 
    failureFlash: true 
})); 

和isAuthenticated功能/中間件定義如下

var isAuthenticated = function(req, res, next) { 
    // if user is authenticated in the session, call the next() to call the next request handler 
    // Passport adds this method to request object. A middleware is allowed to add properties to 
    // request and response objects 
    if (req.isAuthenticated()) { 
    return next(); 
    } else { 
    res.redirect('/login'); 
    } 

} 

我在做什麼錯？

基本上，註冊後，我有一個按鈕，重定向到/，如果我們被重定向到library（就像它發生在我身上），那麼用戶應該已經被認證，但我不想這.. 。

Answer 1

有至少兩個解決辦法：

1. 添加session: false給你傳遞給passport.authenticate('signup', {...})作爲passportjs documentation描述的配置對象。

2. 請勿使用護照進行註冊。護照的主要用途是驗證（並建立會話），DIY註冊邏輯或多或少只是複製護照中間件代碼。