如何更好地在Loopback中获取当前用户ID

Question

As the loopback.getCurrentContext() has long-living unstability problems and deprecated currently, how can I make sure that when a user performs some operations via API endpoints, I know how to identify him?

May be I can send the token id in the request payload and check it? What if user fakes it? What are alternatives to those hacky solutions from the issues page on Github?

Answer 1

Check out https://docs.strongloop.com/display/public/LB/Making+authenticated+requests

In summary, once you've logged a user in it should give you back an AccessToken in the response. You can then use that in the headers or on the query string to prove you're a logged in user:

# Authorization Header
curl -X GET -H "Authorization: $ACCESS_TOKEN" \
http://localhost:3000/api/widgets

# Query Parameter
curl -X GET http://localhost:3000/api/widgets?access_token=$ACCESS_TOKEN

This cannot easily be faked, as the access token is checked on each request to ensure it's current and valid.

Once you've done this, you can get at the accessToken via (taken from https://github.com/strongloop/loopback/issues/569#issuecomment-60924099 except attaching the user to the req object)

app.use(function(req, res, next) {
  app.currentUser = null;
  if (!req.accessToken) return next();
  req.accessToken.user(function(err, user) {
    if (err) return next(err);
    req.currentUser = user;
    next();
  });
});

Add this to your server.js or a boot script and therefore have the user object on ctx.req.currentUser at any point.