在登录 nodejs 上管理会话

Question

我正在尝试在 nodejs 中管理用户会话。 我已经建立了一个仪表板，人们可以在其中管理他们的产品以进行库存等。 我基本上让它现在在用户登录的地方运行，并将用户名存储在全局变量中，然后将 userAuth 设置为 true。 显然在 prod 环境中这是行不通的，所以我试图管理每个 session。 用户应该登录，他们应该有自己的 session，他们所有的数据库凭据都应该从我的主表中提取，然后用于特定的 session。 多个用户应该能够使用它并同时编辑他们的产品和库存。 我已经尝试过 express-session，但没有运气，我做错了什么，但不知道从哪里开始。 这是我的登录代码：

//LOGIN FUNCTIONALITY
app.post("/login", (req, res) => {

  //defining variables for users username & password inputs
  const inputUsername = req.body.inputUsername;
  const inputPassword = req.body.inputPassword;

  //functionality to query db by username
  var userLogin = "select * from login where USERNAME = ?";
  ibmdb.open(ibmdbconnMaster, function (err, conn) {
    if (err) return console.log(err);
    conn.query(userLogin, [inputUsername], function (err, rows) {
      if (err) {
        console.log(err);
      }

  //if the query returns results that are > 0
  if (rows.length > 0) {
    var pass = "";
    userSessionId = req.body.sessionID
    var sessUsername = userUsername

    //loop for getting those values that correspond with the username of the user
    for (var i = 0; i < rows.length; i++) {
      userUsername = rows[i]["USERNAME"];
      pass = rows[i]["PASSWORD"];
      firstName = rows[i]["FN"];
      lastName = rows[i]["LN"];
      company = rows[i]["COMPANY"];
      ibmdbconnDash = rows[i]["DBCONNSTRINGDASH"];
      ibmdbconnBlog = rows[i]["DBCONNSTRINGBLOG"];
      mailerStatus = rows[i]["MAILERSTATUS"];

      //these will be more secure when time comes
      cloudinaryName = rows[i]["CLOUDINARYNAME"];
      cloudinaryKey = rows[i]["CLOUDINARYKEY"];
      cloudinarySecret = rows[i]["CLOUDINARYSECRET"];
    }

    //comparing user input password to hashed db password
    bcrypt.compare(inputPassword, pass, function (err, result) {
      console.log("result is " + result);
      //if the result of the compare is true, then redirect to the index function
      if (result == true) {
        console.log("login works");
        userAuth = "true"
        res.redirect("/index");
      } else {
        //if compare returns false, re-render login page
        userAuth = "false";
        res.render("login.ejs");
        alert("Incorrect username or password. Please try again");
      }
    });
    //if the entire query returns rows < 1 (username and password don't match, then re-render login page)
  } else {
    userAuth = "false";
    res.render("login.ejs");
    alert("Incorrect username or password. Please try again");
  }

  conn.close(function () {
    console.log("closed the function /login");
      });
    });
  });
});

全局变量

 var userAuth = ""
    var userName = "";
    var firstName = "";
    var lastName = "";
    var company = "";
    var password = "";
    var ibmdbconnMaster =
      "db2 conn string";
    var ibmdbconnDash = "";
    var ibmdbconnBlog = "";
    var userUsername = "";
    var mailerStatus = "";
    var cloudinaryName = "";
    var cloudinaryKey = "";
    var cloudinarySecret = "";

我尝试使用 express-sessions 实现会话，我为此设置的代码是他们网站的标准代码：

app.use(session({
secret: "sec",
resave: false,
uninitialized: true,
}))

主索引/登陆页面（仪表板）function

   //DEFINING GLOBAL VARIABLES FOR AUTH
var sessionID = "";
var numOfOrders = "";
var numOfUsersM = "";
var userAuth = ""
var userName = "";
var firstName = "";
var lastName = "";
var company = "";
var password = "";
var ibmdbconnMaster =
  "db conn string";
var ibmdbconnDash = "";
var ibmdbconnBlog = "";
var userUsername = "";
var mailerStatus = "";
var cloudinaryName = "";
var cloudinaryKey = "";
var cloudinarySecret = "";

//manage sessions
app.use(session({
    secret: 'secret-key',
    resave: true,
    saveUninitialized: true,
}))

//rendering login page
app.get("/login", (req, res) => {
  res.render("login.ejs");
});

/
//LOGIN FUNCTIONALITY
app.post("/login", (req, res) => {
//     console.log("sessionsid is: " + req.body.sessionID)
//  sessionID = req.body.sessionID
  //defining variables for users username & password inputs
  const inputUsername = req.body.inputUsername;
  const inputPassword = req.body.inputPassword;

  //functionality to query db by username
  var userLogin = "select * from login where USERNAME = ?";
  ibmdb.open(ibmdbconnMaster, function (err, conn) {
    if (err) return console.log(err);
    conn.query(userLogin, [inputUsername], function (err, rows) {
      if (err) {
        console.log(err);
      }

      //if the query returns results that are > 0
      if (rows.length > 0) {
        var pass = "";
        //var userUsername = ""
        userSessionId = req.body.sessionID
        var sessUsername = userUsername
        //loop for getting those values that correspond with the username of the user
        for (var i = 0; i < rows.length; i++) {
          var userUsername1 = rows[i]["USERNAME"];
          pass = rows[i]["PASSWORD"];
          firstName = rows[i]["FN"];
          lastName = rows[i]["LN"];
          company = rows[i]["COMPANY"];
          ibmdbconnDash = rows[i]["DBCONNSTRINGDASH"];
          ibmdbconnBlog = rows[i]["DBCONNSTRINGBLOG"];
          mailerStatus = rows[i]["MAILERSTATUS"];
          cloudinaryName = rows[i]["CLOUDINARYNAME"];
          cloudinaryKey = rows[i]["CLOUDINARYKEY"];
          cloudinarySecret = rows[i]["CLOUDINARYSECRET"];
        }

        //comparing user input password to hashed db password
        bcrypt.compare(inputPassword, pass, function (err, result) {
          console.log("result is " + result);
          //if the result of the compare is true, then redirect to the index function
          if (result == true) {
            console.log("login works");
            var userAuth1 = "true"
            //successful login
            req.session.user = {
                userUsername1,
                userAuth1
            }
            console.log("rquu1 " + req.session.user.userUsername1)
             res.redirect("/index");
          } else {
            //if compare returns false, re-render login page
            userAuth1 = "false";
            res.render("login.ejs");
            alert("Incorrect username or password. Please try again");
          }
        });
        //if the entire query returns rows < 1 (username and password don't match, then re-render login page)
      } else {
        userAuth = "false";
        res.render("login.ejs");
        alert("Incorrect username or password. Please try again");
      }

      conn.close(function () {
        console.log("closed the function /login");
      });
    });
  });
});



//function for logout page
app.get("/logout", (req, res) => {
  userAuth = "false";
  res.render("login.ejs");
});


//RENDERING INDEX PAGE WITH INFORMATION ABOUT PRODUCTS AND ANALYTICS
app.get("/index", (req, res) => {
//   if (userAuth == "true") {
    if (req.session.user) {
        console.log(req.session.user)
    console.log("username is: " + userName);
   
    
   

    pageName = "/index";

    numOfOrdersFun(req, res, numOfOrders)
    //end of location manager

    //initializing counter
    var counterTest2 = "select * from VISITORS";
    ibmdb.open(ibmdbconnDash, function (err, conn) {
      if (err) return console.log(err);
      conn.query(counterTest2, function (err, rows) {
        if (err) {
          console.log(err);
        }

        for (var i = 0; i < rows.length; i++) {
          var dbCountCurrent = rows[i]["NUM"];
        }

        console.log("currentCount " + dbCountCurrent);

        conn.close(function () {
          console.log("closed the function /login");
        });

        //showing information for products
        var showingDBINFO = "SELECT * FROM PRODUCTS";
        ibmdb.open(ibmdbconnDash, function (err, conn) {
          if (err) return console.log(err);
          conn.query(showingDBINFO, function (err, rows) {
            if (err) {
              console.log(err);
            }
            
            //rendering page with all users information, products, and data from login. also a redirect from the login info.
            res.render("index", {
              page_title: "index",
              data: rows,
              userName: userName,
              FN: firstName,
              LN: lastName,
              CO: company,
              dbcc: dbCountCurrent,
              numOfOrders: numOfOrders,
              mailerStatus: mailerStatus,
            });

            conn.close(function () {
              console.log("closed the function /index);
            });
          });
        });
      });
    });
  } else {
      req.session.user.userAuth1 == "false"
    res.render("login.ejs");
  }
});

但是现在我对如何单独管理每个 session 感到困惑，因为我有这么多全局变量，每个 session 都需要它们，并且用户可以同时使用该应用程序吗？

谢谢您的帮助！

Answer 1

使用 express-session 时，您可以使用req.session object 并存储您的首选数据。 在您的具体示例中，您可以将稍后在代码中需要的有关用户的所有信息设置为req.session.user 。 小例子：

//successful login
req.session.user = {
  userName,
  firstName
}

如果您以后需要访问有关用户的任何信息，只需使用req.session.user.userName 。

此数据存储在服务器端，也可用于新请求。

另请注意，密码不应该是默认密码，而是使用没人知道的强密码。