与 app.use(express.static(...)) 相关的 next() 中间件/路由是什么？

Question

I can serve static assets (which I created by npm run build ing React source code) like this:

app.use('/', express.static(path.join(__dirname, 'apps', 'home', 'build')))

If I want to protect a URL and its static assets, I can do this:

app.use(function(req, res, next) {
  if (!req.isAuthenticated()) {
    res.redirect('/login');
  }
  else {
    app.use('/profile', express.static(path.join(__dirname, 'apps', 'profile', 'build')))
    next();
  }
});

If I don't call next() there, the program hangs when I make an authenticated attempt at /profile .

Which middleware/routes are being called next? Without authentication, app.use(express.static(...)) seems to have no problem serving static assets without next() . Why do I need it now? I don't have GET routes defined for /profile or anything like that.

Answer 1

Attaching middleware dynamically in response to requests is not correct. (An authenticated request will make all future requests work unauthenticated with that code.) Instead, you should put authorization-checking middleware ahead of your file-serving middleware to allow it to intercept requests.

const requireAuthentication = (req, res, next) => {
  if (!req.isAuthenticated()) {
    res.redirect('/login');
  } else {
    next();
  }
};

app.use('/profile',
  requireAuthentication,
  express.static(path.join(__dirname, 'apps', 'profile', 'build')));