koajs / userauth Goto Github PK

View Code? Open in Web Editor NEW

135.0 7.0 19.0 80 KB

koa user auth middleware

License: MIT License

Makefile 1.52% JavaScript 98.48%

koa-middleware koa

userauth's Introduction

koa-userauth

koa user auth abstraction layer middleware.

Install

npm install koa-userauth

Usage

koa-userauth is dependent on koa-session or koa-generic-session.

var koa = require('koa');
var userauth = require('koa-userauth');
var session = require('koa-generic-session');

var app = new koa();
app.keys = ['i m secret'];

app.use(session());
app.use(userauth({
  match: '/user',
  // auth system login url
  loginURLFormatter: function (url) {
    return 'http://login.demo.com/login?redirect=' + url;
  },
  // login callback and getUser info handler
  getUser: async ctx => {
    var token = this.query.token;
    // get user
    return user;
  }
}));

Arguments

If options.match or options.ignore is String instance, we will use path-match transfer it to Regex instance.

/**
 * User auth middleware.
 *
 * @param {Object} [options]
 *  - {String|Regex|Function(pathname, ctx)} match, detect which url need to check user auth.
 *      `''` empty string meaning match all, @see `path-match` package.
 *  - {String|Regex|Function(pathname, ctx)} ignore, detect which url no need to check user auth.
 *      If `match` exists, this argument will be ignored.
 *  - {Function(url, rootPath, ctx)} loginURLFormatter, format the login url.
 *  - {String} [rootPath], custom app url root path, default is '/'.
 *  - {String} [loginPath], default is '/login'.
 *  - {String} [loginCallbackPath], default is `options.loginPath + '/callback'`.
 *  - {String} [logoutPath], default is '/logout'.
 *  - {String} [userField], logined user field name on `this.session`, default is 'user', `this.session.user`.
 *  - {Async Function (ctx)} getUser, get user function, must get user info with `req`.
 *  - {Async Function (ctx, user)} [loginCallback], you can handle user login logic here,return [user, redirectUrl]
 *  - {Function(ctx)} [loginCheck], return true meaning logined. default is `true`.
 *  - {Async Function (ctx, user)} [logoutCallback], you can handle user logout logic here.return redirectUrl
 *  - {Function(ctx)} [getRedirectTarget], customize how to get the redirect target after login
 * @return {Async Function (next)} userauth middleware
 * @public
 */

Login flow

unauth user, redirect to $loginPath?redirect=$currentURL
user visit $loginPath, redirect to options.loginURLFormatter() return login url.
user visit $loginCallbackPath, handler login callback logic.
If user login callback check success, will set req.session[userField], and redirect to $currentURL.
If login check callback error, next(err).
user visit $logoutPath, set req.session[userField] = null, and redirect back.

Source image file

License

MIT

userauth's People

Contributors

Stargazers

Watchers

Forkers

czy88840616 popomore hustxiaoc denghongcai moldauder forkoa mahnunchik dengyaolong ngot yongnanzhu beliefgp cyjake liuxiaogang superchen2 hwstovall isabella232 shaozj

userauth's Issues

回跳URL中不允许包含/login

function formatReferer(ctx, pathname, rootPath) {
  var query = ctx.query;
  var referer = query.redirect || ctx.get('referer') || rootPath;
  if (referer[0] !== '/') {
    // ignore protocol://xxx/abc
    referer = rootPath;
  } else if (referer.indexOf(pathname) >= 0) {
    referer = rootPath;
  }
  return referer;
}

其中referer.indexOf(pathname) >= 0是否应该改为referer.startsWith(pathname)更加合适？
因回跳的url中可能会包含/login字符串，这种情况会引起误判。

windows redirect problems

if (options.rootPath !== '/') {
    options.loginPath = path.join(options.rootPath, options.loginPath);
    options.logoutPath = path.join(options.rootPath, options.logoutPath);
    options.loginCallbackPath = path.join(options.rootPath, options.loginCallbackPath);
  }

https://github.com/koajs/userauth/blob/master/index.js#L65-L69

path.join在windows下是反斜杠，登录跳转地址有误，出现重定向循环

Koa v2 Middleware

Hi,

Are you going to migrate this module to koa v2 middleware signature?

请添加当前执行环境的this到match函数中

RT，
因为简单的path判断并不能满足复杂的处理逻辑。需要获取当前执行环境帮助判断。

https://github.com/koajs/userauth/blob/master/index.js#l132

var loginRequired = !!needLogin.call(this,this.path);

Move to koa-session

https://github.com/koajs/session is now the normal session store

有循环重定向的可能

if (!this.session) {
      debug('this.session not exists');
      // ignore not match path
      if (!loginRequired) {
        debug('not match needLogin path, %j', this.path);
        return yield next;
      }
      debug('relogin again');
      return yield loginHandler.call(this, next);
    }

    // get login path
    if (this.path === options.loginPath) {
      debug('match login path');
      return yield loginHandler.call(this, next);
    }

场景：
当
loginPath=/login
loginHost=demo.xxx.com
浏览器中输入demo.xxx.com/login （带有部分cookie），这是就能跳过第一个判断if (!this.session)
而 if (this.path === options.loginPath) 符合条件！
最终就会执行到loginHandler 的 redirect(this, loginURL);
@fengmk2

Always throw getUser error

Whenever a user which is not logined visit the site, it throws a getUser error. Why is userauth trying to login directly before redirect to login path? In my case, it will always fail.

[feat] fetch get json request return 403 not 302

Describe the feature

When we use fetch to get json data from server，userauth return 302 with redirect url。Fetch will throw TypeError: failed to fetch caused by cors error. It's better to throw 403 with login expired message to make frontend do the re-login easily.

needLogin判断逻辑纠正

return function* userauth(next) {
    var loginRequired = !!needLogin(this.path, this);
    debug('url: %s, path: %s, loginPath: %s, session exists: %s, login required: %s',
      this.url, this.path, options.loginPath, !!this.session, loginRequired);

    if (!this.session) {
      debug('this.session not exists');
      // ignore not match path
      if (!loginRequired) {
        debug('not match needLogin path, %j', this.path);
        return yield* next;
      }
      debug('relogin again');
      return yield* loginHandler.call(this, next);
    }

if (!this.session) 这个判断逻辑能否改成

if (!loginRequired) {
      debug('not match needLogin path, %j', this.path);
      return yield* next;
    } else if (loginRequired && !this.session) {
      debug('this.session not exists');
      debug('relogin again');
      return yield* loginHandler.call(this, next);
    }

因为needLogin这个判断逻辑本身就是让业务方自己去判断是否要走登录校验，如果这里加了只允许已经登录过的逻辑才能走进来，就不太合理了。

thx ^^;