如何使用passport中间件实现多路由下登录数据身份验证及错误展示

1. 修复server.js中的passport初始化逻辑 #

你当前抽离passport.config.js单独维护配置的写法是合理的，错误点在于初始化传参时用了不存在的内存users变量，要替换为MongoDB对应的模型查询方法，修改initializePassport调用段代码为：

const initializePassport = require('./passport.config')
initializePassport(
  passport,
  async email => await Users.findOne({ email: email }),
  async id => await Users.findById(id)
)

同时可以删除开头无用的const router = express.Router()声明。

2. 修复passport.config.js的参数与异步逻辑错误 #

你当前authenticateUser函数多写了无用的status参数导致参数错位，同时没有处理异步查询的等待逻辑，修改后代码如下：

const LocalStrategy = require('passport-local').Strategy
const bcrypt = require('bcrypt')

function initialize(passport, getUserByEmail, getUserById) {
  const authenticateUser = async (email, password, done) => {
    const user = await getUserByEmail(email)
    if (user == null) {
      return done(null, false, { message: 'No user with that email' })
    }
    try {
      if (await bcrypt.compare(password, user.password)) {
        return done(null, user)
      } else {
        return done(null, false, { message: 'Password incorrect' })
      }
    } catch (e) {
      return done(e)
    }
  }

  passport.use(new LocalStrategy({ usernameField: 'email' }, authenticateUser))
  passport.serializeUser((user, done) => done(null, user.id))
  passport.deserializeUser(async (id, done) => {
    const user = await getUserById(id)
    return done(null, user)
  })
}

module.exports = initialize

3. 完善login.js路由逻辑 #

需要补充登录POST请求的passport验证逻辑，同时在GET路由中将flash消息传递给模板：

if( process.env.NODE_ENV !== 'production') {
    require('dotenv').config()
}

const express = require('express')
const router = express.Router()
const Users = require('../models/register')
const passport = require('passport')

router.get('/', (req, res) =>{
    res.render('login/login', { messages: req.flash() })
})

router.post('/', passport.authenticate('local', {
    successRedirect: '/',
    failureRedirect: '/login',
    failureFlash: true
}))

module.exports = router

注：你原有代码中NODE_END是笔误，已修正为NODE_ENV

4. 优化login.ejs错误展示 #

补全消息判空逻辑，修正注册跳转路径：

<h1>Login</h1>
<% if (messages && messages.error) { %>
    <%= messages.error %>
<% } %>
<form action="/login" method="POST">
    <%- include('../partials/register_form.ejs') %>
    <button type="submit">Login</button>
</form>

<a href="/register">Register</a>

内容的提问来源于stack exchange，提问作者Mohamed Necib