如何通过单击浏览器中的后退按钮来修复用户对授权页面的访问

Question

I am trying to build login page by paasportjs library, this is my code, it work without error but whenever one user login successfully and when it logout successfully other user without permission(without login) can see this user's pages, only by click on backward button in browser, I am going to know how I can fix backward problem issue?

//Login Section

const LocalStrategy = require('passport-local').Strategy;
passport.use(new LocalStrategy({
            usernameField: "email",
            passwordField: "password",
            passReqToCallback: true
        },
        (email, password, done) => {
            User.findOne({ email: email }).then(user => {
                    if (!user) {
                        return done(null, false, { message: 'The email is not registered' })
                    }

                    //Match password
                    bcrypt.compare(password, user.password, (err, result) => {
                        if (err) throw err;

                        if (result) {
                            return done(null, user)
                        } else {
                            return done(null, false, { message: "Password incorrect" })
                        }
                    });
                })
                .catch(err => console.log(err))
        })

)

//Serrializer and deserializer section

passport.serializeUser((user, done) => {
    done(null, user.id);
})
passport.deserializeUser((id, done) => {
    User.findById(id, (err, user) => {
        console.log('deserializing user:', user);
        done(err, user);
    });
})

app.listen(process.env.PORT || 8008, process.env.ip, function() {
    console.log('Server is running!');
});

Answer 1

For the apis which return the pages which you want only authenticated users to see add

passport.isAuthenticated

for user to be logged in and to check the authorization of the user

passport.isAuthorized

during defining the route of that api.You can use both in the same request as well. for Example in your code for /dashboard api

app.get('/dashboard', passport.isAuthenticated, passport.isAuthorized('user'), (req, res) => {

    res.render('dashboard', {
        pageName: 'Navid'

    })
})



passport.isAuthenticated = (req, res, next) => {  
    if (req.isAuthenticated()) {
        return next();
    }
    res.status(401);
    return next({"ERR MSG"});
};

passport.isAuthorized = (userType) => {
       return (req, res, next) => {
        if (req.user.userType == userType) {        
            return next();
        }        
        res.status(403);
        return next({"ERR MSG HERE"});
    };
};

these are the passport middleware you need to add in your code