发送标头后无法设置错误

Question

This part of code caused the problem to my app.

router.use(function(req, res, next){
  if(req.user){
    res.locals.username = req.user.username
  }else{
    res.redirect('/login');
  }
  next();
});

router.get('/', function(req, res, next) {
    res.render('dashboard');
});

If I removed the first block, everything worked fine. But the first part have to be there, to act as the auth middleware. But it crashed and I got error of below:

_http_outgoing.js:341
    throw new Error('Can\'t set headers after they are sent.');
    ^

Error: Can't set headers after they are sent.

Answer 1

Try returning immediately after performing the redirect() to avoid further route handler executions that may also try to set headers. You will also want to check req.url before redirecting. For example:

router.use(function(req, res, next){
  if (req.user) {
    res.locals.username = req.user.username
  } else if (!/\/login/i.test(req.url)) {
    return res.redirect('/login');
  }
  next();
});

This will prevent execution from continuing if you are redirecting the request ( redirect() sends (the appropriate) headers).

Answer 2

There are 2 weak points in the code you provided:

1. It redirect() the request and then continue processing it as if nothing happened. It should stop processing the request, in other words not call next() after redirect, as @mscdex correctly pointed out.
2. It always redirects the user to the /login page if the user is not provided. Even if the user is requesting /login , creating endless cycles of redirects: /login -> [no user] -> [redirect /login] -> /login -> [no user] -> ...

The most common pattern to handle user authorization is this:

// middleware to check user authorization
function checkAuth(req, res, next){
  if(req.user){
    res.locals.username = req.user.username
    next(); // authorization handled successfully, continue processing request
  }else{
    res.redirect('/login');
    // finish processing request without calling next()
  }
}

// we add checkAuth middleware to prevent unauthorized users from accessing server root ('/')
router.get('/', checkAuth, function(req, res, next) {
    res.render('dashboard');
});
// but we don't need to check user authorization on '/login'
router.get('/login', function(req, res, next) {
    res.render('...');
});