请检查我的通过电子邮件和密码进行的验证？

huangapple
go评论125阅读模式
英文:

please check my verification using email and password?

问题

I'll provide translations for the code you shared:

  1. 现在我正在尝试在我的类别控制器中检查用户是否已登录，如果已登录，则允许他发布类别，否则显示“您必须登录才能创建类别”，但不管用户是否已登录，类别都会被发布，这让我困扰了4个小时，因为我还是初学者。
  3. 这是问题所在的地方，它绕过了：
  5. 路由部分：
  6. routeCategory.post("/category", (req, res) => {
  7.   if (!req.body || !req.body.category_id) {
  8.     return res.status(400).send("类别丢失");
  9.   }
  11.   const id = req.body.category_id;
  12.   const one = category.categoryData.find(
  13.     (Element) => Element.category_id === id
  14.   );
  15.   const email2 = req.params.email;
  16.   const found = User.data.find((email) => email.email === email2);
  17.   if (User.login(email2, req.body.password) == false) {
  18.     return res.status(401).send("您未经授权");
  19.   } else if (one) {
  20.     return res.status(409).send("类别已存在");
  21.   } else {
  22.     const newCategory = {
  23.       category_id: req.body.category_id,
  24.       categoryName: req.body.categoryName,
  25.     };
  27.     category.createCategory(newCategory);
  28.     return res.sendStatus(201);
  29.   }
  30. });
  32. 登录部分：
  33. static login = function (email, password) {
  34.     // 检查数据数组中是否存在与输入的电子邮件和密码相同的用户
  35.     // 如果是，则返回电子邮件
  37.     const found = User.data.find((element) => {
  38.       return element.email === email && element.password === password;
  39.     });
  40.     console.log(User.data);
  41.     console.log(email, password);
  42.     if (found) {
  43.       return true;
  44.     } else {
  45.       return false;
  46.     }
  47.   };
  48. }

只提供了代码的翻译部分，没有其他内容。

英文:

now im trying to check in my category controller if user logged in let him post category otherwise show him "You must be logged in to create a category" but the category is posted wether user is logged in or not logged in it caused me frustration for 4 hours still beginner

this where the problem it bypass

  2. routeCategory.post("/category", (req, res) => {
  3. if (!req.body || !req.body.category_id) {
  4. return res.status(400).send("category missing");
  5. }
  6. const id = req.body.category_id;
  7. const one = category.categoryData.find(
  8. (Element) => Element.category_id === id
  9. );
  10. const email2 = req.params.email;
  11. const found = User.data.find((email) => email.email === email2);
  12. if (User.login(email2, req.body.password) == false) {
  13. return res.status(401).send("You are not authorized");
  14. } else if (one) {
  15. return res.status(409).send("Category already exists");
  16. } else {
  17. const newCategory = {
  18. category_id: req.body.category_id,
  19. categoryName: req.body.categoryName,
  20. };
  21. category.createCategory(newCategory);
  22. return res.sendStatus(201);
  23. }
  24. });
  2. static login = function (email, password) {
  3. // checking if the email and password are in the data array
  4. // then the email and password must be the same as the user entered it
  5. // return email if it's right
  6. // const found = User.data.find(
  7. //   (element) => element.email === email && element.password === password
  8. // );
  9. const found = User.data.find((element) => {
  10. return element.email === email && element.password === password;
  11. });
  12. console.log(User.data);
  13. console.log(email, password);
  14. if (found) {
  15. return true;
  16. } else {
  17. return false;
  18. }
  19. };
  20. }

答案1

得分: 0

控制访问应该通过单独的中间件来完成：

  1. const checkAccess = (req, res, next) => {
  2.   // 获取用户并检查要求
  3.   if (/* 用户可以访问路由 */) {
  4.     next()
  5.   } else {
  6.     next(new Error("无访问权限"))
  7.   }
  8. }
  10. routeCategory.post("/category", checkAccess, (req, res) => {
  11.   if (!req.body || !req.body.category_id) {
  12.   ....

此外，应该以一种无法使用 === 进行检查的方式存储密码，可以使用 bcrypt 或 argon2 进行密码哈希化。

英文:

Controlling access like this should be done via a separate middleware:

  1. const checkAccess = (req, res, next) => {
  2. // fetch user and check requirements
  3. if (/* user can access route*/) {
  4. next()
  5. } else {
  6. next(new Error("No access"))
  7. }
  8. }
  9. routeCategory.post("/category", checkAccess, (req, res) => {
  10. if (!req.body || !req.body.category_id) {
  11. ....

Also you should be storing the password in a way that checking it with === isn't possible, use bcrypt or argon2 for password hashing.

huangapple
  • 本文由 发表于 2023年6月26日 23:17:20
  • 转载请务必保留本文链接：https://go.coder-hub.com/76558036.html
  • backend
  • express
  • javascript
  • node.js
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定