代码之家 › 专栏 › 技术社区 › William

登录时多次反序列化Passport

passport.js node.js

William · 技术社区 · 8 年前

问题是当我登录时,passport会多次运行反序列化功能。据我所知,这对事情没有任何影响。让它这样做以后可能会有问题。日志如下:

Bloodmorphed has been Serialized
Bloodmorphed has been deserialized
Bloodmorphed has been deserialized
Bloodmorphed has been deserialized
Bloodmorphed has been deserialized
Bloodmorphed has been deserialized
Bloodmorphed has been deserialized

这是护照:

/*jshint esversion: 6 */
const LocalStrategy = require('passport-local').Strategy;
const db = require('../config/db');
const bcrypt = require('bcryptjs');
let io = require('./io');

module.exports = (passport) => {

  // =========================================================================
  // passport session setup ==================================================
  // =========================================================================

  // used to serialize the user for the session
  passport.serializeUser((user, done) => {
    console.log(user.username + ' has been Serialized');
    done(null, user.id);
  });

  // used to deserialize the user
  passport.deserializeUser((id, done) => {
    let sql = 'SELECT * FROM users, users_meta WHERE users.id = ? AND users_meta.id =?';
    db.query(sql, [id, id]).then(results => {
      var userdata = results[0];
      console.log(userdata.username + ' has been deserialized');
      done(null, userdata);
    });
  });

  // Local Strategy login
  passport.use('local-login', new LocalStrategy({
    passReqToCallback: true,
  }, (req, username, password, done) => {
    // Match Username
    let sql = 'SELECT * FROM users WHERE username = ?';
    db.query(sql, [username]).then(results => {
      if (!results.length) {
        return done(null, false, {
          type: 'loginMessage',
          message: 'Wrong Login',
        });
      }

      //  Match Password
      bcrypt.compare(password, results[0].password, (err, isMatch) => {
        if (isMatch) {
          var userData = results[0];
          sql = 'SELECT * FROM users_meta WHERE id = ?';
          db.query(sql, userData.id).then(results => {
            Object.assign(userData, results[0]);
            return done(null, userData);
          });

        } else {
          return done(null, false, {
            type: 'loginMessage',
            message: 'Wrong Login',
          });
        }
      });
    });
  }));
};

虽然到目前为止,这还不是一个高度优先的问题,但我想把它修好,或者如果发生这种情况确实很正常的话。

2 回复 | 直到 8 年前

RedDragon 8 年前

请参阅 https://github.com/jaredhanson/passport/issues/14#issuecomment-4863459

静态文件的服务应该在 passport.session .

例如,据参考消息来源:

app.configure(function() {
  app.use(express.session({ secret: 'keyboard cat' }));
  app.use(passport.initialize());
  // passport session is triggered, causing deserializeUser to be invoked
  app.use(passport.session());
  // but request was for a static asset, for which authentication is not
  // necessary
  app.use(express.static(__dirname + '/../../public'));
});

应更改为:

app.configure(function() {
  app.use(express.logger())
  // requests for static assets will be handled immediately and will not continue
  // down the middleware stack
  app.use(express.static(__dirname + '/../../public'));
  // any request that gets here is a dynamic page, and benefits from session
  // support
  app.use(express.session({ secret: 'keyboard cat' }));
  app.use(passport.initialize());
  app.use(passport.session());
});

-1

metal_jacke1 8 年前

如果内存服务正确,Passport将在每个请求上反序列化。因为会话密钥存储在用户浏览器的cookie中。

从 PassportJS documentation :

在典型的web应用程序中,用于验证用户仅在登录请求期间传输。如果身份验证成功后,将建立并维护会话通过用户浏览器中的cookie集。

每个后续请求将不包含凭据,而是包含标识会话的唯一cookie。为了支持登录会话,Passport将序列化和反序列化用户实例以从会议开始。