Google+登录-该页面仅适用于已登录用户

Question

I decided to use social media benefits on my page and currently I'm implementing Google+ Sign-In.

One of the pages on my website should be accessible for logged in users only (adding stuff to the page). I am logging user to website via JavaScript.

I'm aware that javascript is executed on client-side but I am curious is it possible to restrict access to the certain page using only javascript.

Answer 1

Here is one way to do this, with comments throughout:

var authenticate = function(req, success, failure) {

    // Use the Google strategy with passport.js, but with a custom callback.
    // passport.authenticate returns Connect middleware that we will use below.
    //
    // For reference: http://passportjs.org/guide/authenticate/
    return passport.authenticate('google', 
        // This is the 'custom callback' part
        function (err, user, info) {

            if (err) { 
                failure(err);
            }
            else if (!user) { 
                failure("Invalid login data");
            }
            else {
                // Here, you can do what you want to control 
                // access. For example, you asked to deny users 
                // with a specific email address:
                if (user.emails[0].value === "no@emails.com") {
                    failure("User not allowed");
                }
                else {
                    // req.login is added by the passport.initialize() 
                    // middleware to manage login state. We need 
                    // to call it directly, as we're overriding
                    // the default passport behavior.
                    req.login(user, function(err) {
                        if (err) { 
                            failure(err);
                        }
                        success();
                    });
                }
            }
        }
    );
};

One idea is to wrap the above code in some more middleware, to make it easier to read:

// This defines what we send back to clients that want to authenticate
// with the system.
var authMiddleware = function(req, res, next) {

    var success = function() {
        res.send(200, "Login successul");
    };

    var failure = function(error) {
        console.log(error);
        res.send(401, "Unauthorized"); 
    };

    var middleware = authenticate(req, success, failure);
    middleware(req, res, next);
};


// GET /auth/google/return
//   Use custom middleware to handle the return from Google.
//   The first /auth/google call can remain the same.
app.get('/auth/google/return', authMiddleware);

Credits : https://stackoverflow.com/a/13734798/1670308

Answer 2

You cannot perform reliable access control using only client-side javascript.

This is because since the javascript is executed on the user's browser, the user will be able to bypass any access control rule you've set there.

You must perform your access control on server-side, in your case in Python code.

Generally, people also perform some kind of access control check on the client side, not to prevent access, but for example to hide/disable buttons that the user cannot use.