我想使用 Next-Auth 实现会话管理系统

Question

我想实现一个管理会话系统，以便用户在更改密码时可以注销所有会话。

1-当用户登录时，我会将他的会话存储到用户会话数组中：

2- 我会检查当前会话是否存储在数据库中，如果没有，我会将他注销。

3- 我想添加一个“注销所有会话”按钮，用于注销除当前会话之外的所有会话。

但我不知道如何开始，因为当用户登录时我只有：

{
  user: { uid: '61a53559b7a09ec93f45f6ad' },
  expires: '2021-12-30T16:34:58.437Z',
  accessToken: undefined
}
{
  user: { uid: '61a53559b7a09ec93f45f6ad' },
  iat: 1638290097,
  exp: 1640882097,
  jti: '2fc85541-eb9b-475e-8261-50c874f85b51'
}

我的 [next-auth].js ：

import NextAuth from "next-auth";
import CredentialsProvider from "next-auth/providers/credentials";
import mongoose from "mongoose";
import { compare } from "bcrypt";
import { User } from "../auth/signup"

export default NextAuth({
    //configure json web token
    session: {
        strategy: "jwt",
        maxAge: 30 * 24 * 60 * 60,
        updateAge: 24 * 60 * 60,
    },
    providers: [
        
        CredentialsProvider({
            async authorize(credentials){
                //connect to database
                const client = await mongoose.connect(process.env.DB_URI);
                //search for user using email or username
                const result = await User.findOne({$or: [{email: credentials.username}, {username: credentials.username}]});
                //if not found
                if(!result){
                    client.connection.close();
                    throw new Error("Incorrect username or password.");
                }
                const checkPassword = await compare(credentials.password, result.password);
                //of password doesn't match
                if(!checkPassword){
                    client.connection.close();
                    throw new Error("Incorrect username or password.")
                }
                
                client.connection.close();

                if(!result.emailVerified.verified){
                    client.connection.close();
                    throw new Error("Please verify your email adress.") 
                }

                return {
                   uid: result._id
                };
            }
        }),
    ], 
    callbacks: {
        async jwt({ token, user, account }){
            if (account) {
                token.accessToken = account.access_token
            }

            user && (token.user = user)
            return token
        },
        async session({ session, token }){
            session.user = token.user;
            session.accessToken = token.accessToken;
            
            return session;
        }
    }

});

Answer 1

我为每个用户创建了一个会话数组，当用户登录时，我生成一个随机哈希键并将其保存到这个数组中（您可以添加自定义属性，例如 IP、时间.. 等），然后保存这个哈希到cookies，然后我在getServerSideProps中添加了一个请求

export async function getServerSideProps(context){

    const {data: isAuthenticated} = await axios.get(`${process.env.WEB_URI}/api/auth/verify/session`, {
      headers: {
        cookie: context.req.headers.cookie
      }
    });

/api/auth/verify/session.js

export default async function session(req, res){

    if(req.method === "GET"){
        const session = await getSession({req: req});
        if(!session){
         return res.send(false);
        }

        mongoose.connect(process.env.DB_URI, {useUnifiedTopology: true} , async function(error) {
            if(!error){    
                const user = await User.findOne({uid: session.user.uid}, {_id: 0, sessions: 1});
                
                if(!user){
                    return res.send(false);
                }

                const userSession = user.sessions;
                if(userSession.length > 0){
                    const tokens = userSession.map((session => session.token));
                    
                    if(tokens.includes(session.user.token)){
                        res.send(true);
                    }else{
                        res.send(false);
                    }
                }else{
                    res.send(false);
                }
            }
        });
  }
}

终于

 if(props.isAuthenticated === false){
        signOut();
    }