Node.js中的登录身份验证

Question

I have 2 main pages. One page is

• mywebsite.com/login

• mywebsite.com

/login page shows login and password page. When the user successfully gets authenticated, the mywebsite.com page opens.

mywebsite.com/login goes to login.js file on server

mywebsite.com/ goes to index.js file on the server

I want to maintain a session across both page. If the user isn't loggedin, I want the mywebsite.com/ to redirect to /login.

I have read about req.session but I don't know how to know about req.session value of login.js inside index.js.

app.js

var login = require('./routes/login');
var routes = require('./routes/index');

var app = express();

app.use('/login', login);
app.use('/', routes);


// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'ejs');

login.js

router.get('/', function(req, res, next) {
  res.render('login', { title: 'Login' });
});

router.post('/isEmployeeAdmin', function(req, res, next) {
  console.log("req is: ", req.body);
  employeeController.isEmployeeAdmin(req.body, function (response, data) {
    response.data = data;
    if (!response.success) {
      console.error("error is: ", response.message);
      res.status(200).send(response);
      return;
    }

    res.status(200).send(response);
    console.log("success in finding if employee is admin ", response.data);
  });
});

index.js

router.get('/', function(req, res, next) {

    if(req.session.loggedIn)
          res.render('index', { title: 'WinGoku' });
    else
        res.status(404).send(); // or redirect to login.ejs file
});

What am I doing wrong? How can I do it?

Answer 1

I suggest you use the express-session npm Module to maintain sessions. https://www.npmjs.com/package/express-session

You need to include it in your app.js

var session = require('express-session');

Give it a secret key

app.use(session({secret: 'anystringhere'}));

And change this code a bit

if (!response.success) {
      console.error("error is: ", response.message);
      res.status(200).send(response);
      return;
    }
else{
   req.session.loggedIn = true;
}

This should do the trick