NodeJS /将所有请求表达到特定路径

Question

I'm not looking to serve a static folder/files. That being cleared, here is my issue:

I have a Login page, and after the user has been verified, I create a session. Based on this session, I want to give the client access/denial to every request they make to the url path example.com/admin

Why? I have API calls to this url but also a file inside /public/admin/dashboard.html (and yes the /public folder is served as a static folder) - and all of these incoming requests should just be possible from clients with verified sessions.

I tried to use app.get("/admin/*",... but that seems also to affect all the other domains with get requests:

app.get("/admin/*", function(req, res) {
    if (req.session.email !== undefined) {
      console.log("User is verified to access");
      return res.redirect("/admin/dashboard.html");
    } else {
      console.log("Failed: User not verified, redirect to 404");
      return res.redirect("/404.html");
    }
  })

And the code above is called before the

app.use(express.static("./public"));

Answer 1

I'm not sure if you're having problems with the wildcard url matching, or serving up the static file. Here is an example on how to use a middleware to take care of the authorization and then serve up the static file from a specific endpoint.

It's not a copy paste to solve your problem, but I hope this might help you find a solution.

const authenticate = function(req, res, next) {
  if (req.sess.email === undefined) {
    return res.redirect('/404/.html');
  }
  next();
}

app.get('/admin/dashboard.html', auhenticate, function(req, res) {
    console.log('User is verified to access');
    return res.sendFile([File location for dashboard.html],
                        {headers: {'Content-Type': 'text/html'}});
});

Answer 2

Write a function to validate users to allow /admin/* route and then use it as follows:

function validate(req, res, next){
  //logic to verify user, validate session
  if(user is allowed to access){
    next();//Proceed to handle the request
  }
  else{
    //end request with 401 as unauthorized
    res.status(401).send();
  }
}
app.get("/admin/*", validate, function(req, res) {
    //Actual response to send
  });

You can use validate functionality for any requests which need authorization.

UPDATE: My bad. /admin checks for the URLs ending with /admin only. Hence, /admin/dashboard.html won't work. If you want the authorization check to all URLs that have /admin in the them, then regex pattern can be used like /admin/* and then send response once validated. Hope this explains your query.

Answer 3

Thanks to @lifetimeLearner007 and @R.Gulbrandsen who lead me into the right direction. For anyone following up, a combination of both solved it (but dont know why)

app.get("/admin/*", validateUser, function(req, res, next) {
    console.log("Validated");
    next();
  })

function validateUser(req, res, next) {
    console.log(req.session.email)
    if (req.session.email !== undefined) {
      console.log("User is verified to access");
      next();
    } else {
      console.log("Failed: User not verified, redirect to 404");
      return res.redirect("/404.html");
    }
  }