nodejs护照BasicStrategy未经授权

Question

我正在尝试使用BasicStrategy 测试简单的护照身份验证。我可以使用电子邮件和密码创建用户（密码是散列的）。但是，当我signin 时，我正在获得未经授权的权限

app.js

const express = require('express');
const app = express();
var bodyParser = require('body-parser');
var passport = require('passport');
var BasicStrategy = require('passport-http').BasicStrategy;

const index = require('./routes/index.js');
const userRouter = require('./routes/user');
const User = require('./models/User');

// connect to mongodb
var mongoose = require('mongoose');
mongoose.connect('mongodb://localhost:27017/test', {useNewUrlParser: true})
  .then(() => {
    console.log('connected to mongodb');
  }).catch(err => {
    console.log("Connection failed with an error " + err);
  });

passport.use(new BasicStrategy(
  function (email, password, done) {
    User.findUserByEmail(email, function(err, user) {
      if (err) {
        return done(err);
      }

      if (!user) {
        return done(null, false, {message: 'User not found'});
      }

      User.comparePassword(password, user.password, function(err, isMatch) {
        if (err) {
          return done(err);
        }
        if (isMatch) {
          return done(null, user);
        } else {
          return done(null, {message: 'Invalid password'});
        }
      });
    });
  }
));

// Middleware
app.use(passport.initialize());
app.use(bodyParser.urlencoded({ extended: true }));
app.use("/users", userRouter);


app.get('/', index);

app.listen(3000, () => console.log(`Open http://localhost:3000 to see a response.`));

routes/user.js

var express = require('express');
var router = express.Router();
var passport = require('passport');
var User = require('../models/User');

router.post('/create', function(req, res) {
  var newUser = new User({
    name: req.body.name,
    email: req.body.email,
    password: req.body.password,
    role: 'student',
  });

  User.createUser(newUser, function(err, user) {
    if (err) throw err;

    res.send(user).end();
  });
});

router.post('/signin',
  passport.authenticate('basic', {session: false}),
  function(req, res) {
    res.send({
      status: 'success',
    });
});

module.exports = router;

models/User.js

var mongoose  = require('mongoose');
var bcrypt = require('bcryptjs');

var UserSchema = mongoose.Schema({
    name: String,
    email: {
      type: String,
      index: true,
      unique: true
    },
    password: String,
});

var User = module.exports = mongoose.model('User', UserSchema);

module.exports.createUser = function(newUser, callback){
  bcrypt.genSalt(10, function(err, salt) {
    bcrypt.hash(newUser.password, salt, function(err, hash) {
        newUser.password = hash;
        newUser.save(callback);
    });
  });
}

module.exports.findUserByEmail = function(email, callback) {
  User.findOne({email: email}, callback);
}

module.exports.comparePassword = function(password, passwordHash ,callback) {
  bcrypt.compare(password, passwordHash, function(err, isMatch) {
    if (err) throw err;

    callback(null, isMatch);
  });
}

通过 curl 创建用户

curl -X POST -d 'name=John' -d 'email=test@gmail.com' -d 'password=123456' http://localhost:3000/users/create

{"_id":"5d0790633c0a7857b6154654","name":"John","email":"test@gmail.com","password":"$2a$10$GqFoxNhEOw2sCLNS8QfWx.xiAsZ8Y6/cQyeM1qseSeX7dhPA6D0dW","__v":0}

但是，登录失败；

curl -X POST -d 'email=test@gmail.com' -d 'password=123456' http://localhost:3000/users/signin

Unauthorized

非常感谢您的帮助。谢谢！

Answer 1

你的要求应该是

curl -X POST --user username:password <<loginURL>> or 
curl -X POST -u username:password <<loginURL>>

Answer 2

问题基本上是您使用的是 HTTP 基本身份验证 Passport 策略。如果您将登录请求更改为以下内容，它将起作用：

curl -X POST --user test@gmail.com:123456 http://localhost:3000/users/signin

请参阅here，了解有关使用 curl 和基本身份验证的更多详细信息。

如果您确实想使用电子邮件和密码正文参数，可以查看Passport local strategy。