客户端会话中间件问题：设置后 req.session_state = undefined

Question

让客户端会话中间件在 Express 中工作时遇到了一些问题。简而言之，在设置后重定向到新路由时似乎无法访问 session_state。作为参考，我关注了this video tutorial（客户端会话部分大约在 36:00 开始）并仔细检查了我的步骤，但仍然遇到问题。中间件设置如下：

var sessions = require('client-sessions');

使用来自 Express 网站的代码进行实例化。

app.use(sessions({
 cookieName: 'session',
 secret: 'iljkhhjfebxjmvjnnshxhgoidhsja', 
 duration: 24 * 60 * 60 * 1000,
 activeDuration: 1000 * 60 * 5 
}));

如果有任何区别，我将会话中间件放置在 bodyParser 和路由之间。

以下是我的routes/index.js 与该问题相关的部分。 req.session_state 似乎设置正常，并且正确的用户详细信息记录到控制台。

// POST login form
router.post('/login', function(req, res) {
  User.findOne( { email: req.body.email }, function(err,user){
    if(!user) {
      console.log("User not found...");
      res.render('login.jade', 
         { message: 'Are you sure that is the correct email?'} );
    } else {
        if(req.body.password === user.password) {

        // User gets saved and object logs correctly in the console
            req.session_state = user;
            console.log("session user...", req.session_state);

            res.redirect('/dashboard'); 
        }
    }
    //res.render('login.jade', { message: 'Invalid password'} );
  });
});

但是，运行 res.redirect('/dashboard'); 时出现了问题，因为 session_state 在到达该路由时不可访问。这是/dashboard 路由的代码。

router.get('/dashboard', function(req, res) {

   // OUTPUT = 'undefined' ???
   console.log("dash...", req.session_state);

   // 'if' fails and falls through to /login redirect
   if(req.session && req.session_state){
       console.log("dash route...", req.session_state);
       User.findOne( { email: req.session_state.email }, function
        (err, user){
         if(!user){
            req.session.reset();
            res.redirect('/login');
         } else {
            res.locals.user = user;
            res.render('dashboard.jade')
         }
      });
   } else {
    res.redirect('/login');
   }
   //res.render('dashboard', { title: 'Your Dashboard' });
});

基本上，存储在 session_state 中的对象在 /dashboard 重定向后无法访问。我一直在尝试调试它一天左右，但没有任何运气。非常感谢任何帮助。抱歉，如果我遗漏了一些明显的东西。只是用会话中间件弄湿了我的脚，所以也许我还没有完全掌握 Session 或者我忽略了一些东西。提前致谢！

Answer 1

我已经用可以帮助您设置 cookie 和称为令牌的替代会话管理器的代码更新了我的答案。在此示例中，我已将部件提供给中间件，其中一部分附加 cookie（可以扩展以确定您的用例），第二部分检查令牌是否过期或其中可能存在的其他内容（即受众、发行人等）

 app.use('/js/',function(req, res, next) {
//check if the request has a token or if the request has an associated username
         if(!req.headers.cookie){

            console.log('no cookies were found')

            var token = jwt.sign({user_token_name:req.body.user_name},app.get('superSecret'), {
                expiresIn: 1 *100 *60 // expires in 1 mintue can be what ever you feel is neccessary
            });
             //make a token and attach it to the body
             // req.body.token = token // this is just placing the token as a payload
             res.cookie('austin.nodeschool' , token,{ maxAge: 100000, httpOnly: true }) //this sets the cookie to the string austin.nodeschool
         }
        if(req.body.user_name){
             next()
         }else{
             res.send('request did not have a username').end() // this is here because my middleware also requires a username to be associated with requests to my API, this could easily be an ID or token.
         }
    },function(req, res, next) {
//    console.log(req.headers)  this is here to show you the avilable headers to parse through and to have a visual of whats being passed to this function
            if(req.headers.cookie){
                console.log(req.headers.cookie) //the cookie has the name of the cookie equal to the cookie.
                var equals = '=';
                var inboundCookie = req.headers.cookie
                var cookieInfo = splitCookie(inboundCookie,equals) //splitCookie is a function that takes the inbound cookie and splits it from the name of the cookie and returns an array as seen below.
                console.log(cookieInfo)
               var decoded = jwt.verify(cookieInfo[1], app.get('superSecret'));

                console.log(decoded)
                // You could check to see if there is an access_token in the database if there is one
                // see if the decoded content still matches. If anything is missing issue a new token
                // set the token in the database for later assuming you want to       
                // You could simply check if it's expired and if so send them to the login if not allow them to proceed through the route. 
            }
    next()
    });