如何通过 REST API 处理 MongoDB 登录？

Question

I'm not sure how to check if the values match with the MongoDB data. I am using PUT and trying to use findOneAndUpdate to check if the values match.

<script>
const logindetails = new Vue({
el: '#logindetails',
data: {

    email: "",
    password: "",
    on: Boolean
},

methods: {
    login: function (e) {
        e.preventDefault();

        const log = {
            email: this.email,
            password: this.password,
        }

        const options = {
            method: 'PUT',
            headers: {
              'Content-Type': 'application/json'
            },
            body: JSON.stringify(log)
        };

       fetch('http://localhost:3000/users/${this.email}/${this.password}', 
options).then(response => {

[...]

</script>

This is the server code (it successfully connected to MongoDB) :

app.put('/students/:email/:password', (req, res, next) => {
console.log("login");
res.setHeader("Content-Type", "application/json");
db.collection('users').findOne({email: (req.params.email), password: (req.params.password)},
    {$set: {on: true}})
    .then(results => res.send(results))
    .catch(err => res.send(err))
});

Answer 1

I personally don't think it is a good idea to put your username and password as query string, because it hurts the restful api convention. It wouldn't make sense to use a put request if there is no body being pass. Also, a post request would make more sense in a login situation .Anyway I digress, here are the usual steps to doing authentication.

1. (Client-Side) Send the email and password in the body of the fetch request

//something like this

const body = { email, password };
  const response = await fetch(
    "http://localhost:5000/authentication/login",
    {
      method: "POST",
      headers: {
        "Content-type": "application/json"
      },
      body: JSON.stringify(body)
    }
  );

2. (Server-Side - make sure you to use app.use(express.json()) to access req.body )

//defining middleware to access req.body

app.use(express.json());

app.post("/authentication/login", async(req,res) =>{
    //1. destructure email and password

    const {email, password} = req.body

    //2. check if user doesn't exist

    const user = await db.user.find({user_email: email})
    if(!user){
        return res.status(401).send("User does not exist");
    }

    //3. Check if password is the same as the password in the database

    if(password !== user.password){
        return res.status(401).send("Wrong Credential")
    }

    //4. This is up to you when the user is authenticated

    res.json(`Welcome back ${email}`);
})