如何在现有Node.js+Express+MongoDB API中添加OAuth认证？

Awesome work getting your CRUD API up and running with Node.js, Express, and MongoDB! Adding OAuth authentication is a fantastic way to lock down your endpoints and ensure only authorized users can access your data. Let’s walk through exactly how to implement this, step by step.

First, let’s grab the tools we need to handle OAuth and token validation. Run this command in your project directory:

npm install passport passport-oauth2 jsonwebtoken dotenv express-session

• passport: The de facto authentication middleware for Express.
• passport-oauth2: The base strategy for OAuth 2.0 flows.
• jsonwebtoken: To generate and verify stateless JWT tokens for API access.
• dotenv: To safely store sensitive credentials like OAuth client IDs.
• express-session: Optional but helpful for managing Passport’s session state during the OAuth flow.

Create a .env file in your project root to keep sensitive data out of your codebase:

OAUTH_CLIENT_ID=your_oauth_provider_client_id
OAUTH_CLIENT_SECRET=your_oauth_provider_client_secret
OAUTH_AUTH_URL=https://your-oauth-provider.com/oauth/authorize
OAUTH_TOKEN_URL=https://your-oauth-provider.com/oauth/token
OAUTH_CALLBACK_URL=http://localhost:3000/auth/oauth2/callback
JWT_SECRET=a_strong_random_string_for_jwt_signing
PORT=3000

Replace the placeholder values with details from your chosen OAuth provider (e.g., Google, GitHub, or a custom OAuth server).

Create a config/passport.js file to set up Passport’s OAuth strategy and user handling:

const passport = require('passport');
const OAuth2Strategy = require('passport-oauth2').Strategy;
const jwt = require('jsonwebtoken');
const User = require('../models/User'); // Your existing User model

passport.use(new OAuth2Strategy({
    authorizationURL: process.env.OAUTH_AUTH_URL,
    tokenURL: process.env.OAUTH_TOKEN_URL,
    clientID: process.env.OAUTH_CLIENT_ID,
    clientSecret: process.env.OAUTH_CLIENT_SECRET,
    callbackURL: process.env.OAUTH_CALLBACK_URL
}, async (accessToken, refreshToken, profile, done) => {
    try {
        // Check if the user already exists in your MongoDB
        let user = await User.findOne({ oauthId: profile.id });
        
        // If not, create a new user record
        if (!user) {
            user = new User({
                oauthId: profile.id,
                name: profile.displayName,
                email: profile.emails?.[0]?.value // Adjust based on your provider's profile data
            });
            await user.save();
        }

        // Generate a JWT for the client to use in future API requests
        const jwtToken = jwt.sign(
            { userId: user._id },
            process.env.JWT_SECRET,
            { expiresIn: '24h' }
        );

        return done(null, { user, token: jwtToken });
    } catch (err) {
        return done(err, null);
    }
}));

// Serialize/deserialize user for session management (simplified for API use)
passport.serializeUser((userData, done) => {
    done(null, userData.user._id);
});

passport.deserializeUser(async (userId, done) => {
    try {
        const user = await User.findById(userId);
        done(null, user);
    } catch (err) {
        done(err, null);
    }
});

module.exports = passport;

Update your main app.js file to initialize Passport and add the OAuth login/callback routes:

require('dotenv').config();
const express = require('express');
const passport = require('./config/passport');
const session = require('express-session');
const app = express();

// Parse JSON bodies (required for your existing CRUD routes)
app.use(express.json());

// Configure session for Passport (adjust secret for production!)
app.use(session({
    secret: process.env.JWT_SECRET,
    resave: false,
    saveUninitialized: false
}));

// Initialize Passport and session support
app.use(passport.initialize());
app.use(passport.session());

// OAuth login route (redirects to provider's login page)
app.get('/auth/oauth2', passport.authenticate('oauth2'));

// OAuth callback route (handles provider's response)
app.get('/auth/oauth2/callback',
    passport.authenticate('oauth2', { failureRedirect: '/auth/failed' }),
    (req, res) => {
        // Send JWT and user data back to the client on successful login
        res.json({
            message: 'Login successful',
            token: req.user.token,
            user: req.user.user
        });
    }
);

// Optional: Handle login failures
app.get('/auth/failed', (req, res) => {
    res.status(401).json({ message: 'OAuth login failed' });
});

// Import and use your existing CRUD routes here
const crudRoutes = require('./routes/crud');
app.use('/api', crudRoutes);

app.listen(process.env.PORT, () => {
    console.log(`Server running on port ${process.env.PORT}`);
});

Build a middleware to protect your CRUD endpoints by validating JWT tokens. Create middleware/auth.js:

const jwt = require('jsonwebtoken');
const User = require('../models/User');

const authenticateToken = async (req, res, next) => {
    // Extract token from Authorization header (format: Bearer <token>)
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1];

    if (!token) {
        return res.status(401).json({ message: 'Access token is required' });
    }

    try {
        // Verify the JWT token
        const decoded = jwt.verify(token, process.env.JWT_SECRET);
        // Fetch the user from MongoDB to confirm they exist
        const user = await User.findById(decoded.userId);
        
        if (!user) {
            return res.status(401).json({ message: 'Invalid token' });
        }

        // Attach user data to the request for use in routes
        req.user = user;
        next(); // Proceed to the protected route
    } catch (err) {
        return res.status(403).json({ message: 'Token is invalid or expired' });
    }
};

module.exports = authenticateToken;

Update your existing CRUD routes to use the authentication middleware. For example, in routes/crud.js:

const express = require('express');
const router = express.Router();
const authenticateToken = require('../middleware/auth');
const Post = require('../models/Post'); // Your existing CRUD model

// Get all posts (PROTECTED)
router.get('/posts', authenticateToken, async (req, res) => {
    try {
        const posts = await Post.find();
        res.json(posts);
    } catch (err) {
        res.status(500).json({ message: err.message });
    }
});

// Create a new post (PROTECTED)
router.post('/posts', authenticateToken, async (req, res) => {
    const post = new Post({
        title: req.body.title,
        content: req.body.content,
        author: req.user._id // Attach authenticated user as author
    });

    try {
        const newPost = await post.save();
        res.status(201).json(newPost);
    } catch (err) {
        res.status(400).json({ message: err.message });
    }
});

// Add other CRUD routes (PUT, DELETE) with authenticateToken middleware...

module.exports = router;

1. Start your server, then visit http://localhost:3000/auth/oauth2 in your browser. You’ll be redirected to your OAuth provider’s login page.
2. After logging in successfully, you’ll get a JSON response with a JWT token and user data.
3. Use tools like Postman or curl to send requests to your CRUD endpoints, adding the token to the Authorization header as Bearer <your-jwt-token>. You’ll only get access if the token is valid!

• Third-Party Providers: If you want to use Google, GitHub, or other popular providers, swap passport-oauth2 for provider-specific strategies (e.g., passport-google-oauth20). The setup is nearly identical—just update the strategy configuration.
• Production Security: Always use HTTPS in production to prevent token interception. Rotate your JWT secret and OAuth client credentials regularly.
• Token Refresh: Implement a refresh token flow to let users get new access tokens without re-logging in.

内容的提问来源于stack exchange，提问作者BhAvik Gajjar