问题

Here is the translated code portion:

 callbacks: {
        async session({ session, token, user }) {
          // Send properties to the client, like an access_token and user id from a provider.
          const getUserEmail = session.user.email;
          const userData = await User.findOne({ email: getUserEmail }).select('-password');
          session.user = userData;
          return session;
        }

As for your question about the safety of this approach, it appears that this code is responsible for customizing the user session data obtained through Next-Auth CredentialsProvider. It fetches user information from MongoDB based on the email address and excludes the password.

In terms of security, this approach seems reasonable as long as you have proper authentication and authorization mechanisms in place. However, it's important to ensure that the MongoDB query is secure and properly validated to prevent any potential security vulnerabilities like SQL injection.

Regarding your consideration of including more user profile information (name, image, etc.) in the session, it's generally a good practice to only store essential information in the session. You can retrieve additional user profile data when needed from the database or another secure source rather than storing it all in the session, which can reduce the risk of exposing sensitive data.

If you have specific security concerns or need more detailed advice, it's recommended to consult with a security expert or conduct a thorough security review of your codebase.

 callbacks: {
    async session({ session, token, user }) {
      // Send properties to the client, like an access_token and user id from a provider.
     const getUserEmail = session.user.email;
      const userData = await User.findOne({ email: getUserEmail }).select('-password');
      session.user = userData
      return session
    }

答案1

得分: 1

在安全领域，你必须亲自编写代码。使用像Next-Auth这样存在许多问题的库是不安全的。

编写一个库以实现安全的身份验证非常简单。你只需使用JWT并拥有安全的JWT-SECRET-KEY。就是这样！

我编写了一些有用的库，以在Next.js中实现安全的身份验证：

1. 使用签名和解码JWT：jsonwebtoken

2. 在客户端解码会话（JWT）而无需使用秘钥。这将帮助您在客户端安全地解码，因为您不传递秘钥。您可以仅用于像配置文件名之类的简单内容。jwt-decode

3. 在Linux中创建安全的JWT-SECRET-KEY，请在终端中使用此代码：

   openssl rand -base64 60

4. 将令牌保存为cookie，请使用这些库。我尝试了许多库，但它们不能正常工作：（推荐）-> cookies-next，如果你不喜欢它，可以使用 nookies

5. （可选）：如果您想将JWT会话保存在数据库中，这是不必要的，如果您的秘钥是安全的，您可以使用这个ORM：Prisma