React Native与Node.js后端无用户无会话身份认证实现咨询

Hey there! Let's walk through how to implement exactly what you're asking for—since you don't want sessions, user accounts, and need to restrict API access to only your React Native app using device UUIDs, we can adapt Passport.js with a custom strategy to make this work perfectly.

Instead of using Passport's standard session-based strategies (like local or OAuth), we'll build a custom validation strategy that checks two key things for every API request:

1. A secret key embedded in your React Native app (to ensure it's your app making the request)
2. A valid device UUID (to establish that "handshake" you mentioned)

Since you don't want a user system, we won't store any user data—we'll just validate these two pieces of information on each request, and reject (or ignore) any external requests that fail the check.

1. Set Up Dependencies #

First, install Passport and the custom strategy package (which lets us define our own validation logic):

npm install passport passport-custom

2. Create the Custom Passport Strategy #

In your Node.js backend, define a strategy that validates the request headers containing your app secret and device UUID. We'll also handle blocking/ignoring invalid requests here.

const passport = require('passport');
const CustomStrategy = require('passport-custom').Strategy;

// Load your app secret from environment variables (NEVER hardcode this!)
const VALID_APP_SECRET = process.env.YOUR_APP_SECRET;

passport.use('app-uuid-auth', new CustomStrategy(async (req, done) => {
  // Extract values from request headers
  const deviceUuid = req.headers['x-device-uuid'];
  const appSecret = req.headers['x-app-secret'];

  // First: Validate the app secret to ensure it's your RN app
  if (!appSecret || appSecret !== VALID_APP_SECRET) {
    // Option 1: Return 403 Forbidden
    return req.res.status(403).end();
    // Option 2: Ignore the request entirely (no response sent)
    // return req.res.end();
  }

  // Second: Validate the UUID format (basic check to ensure it's a valid UUID)
  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
  if (!deviceUuid || !uuidPattern.test(deviceUuid)) {
    return req.res.status(403).end(); // Or req.res.end() to ignore
  }

  // If all checks pass, mark the request as authenticated
  // We don't need a user object here since you don't have a user system
  return done(null, true);
}));

3. Protect Your API Routes #

Apply the custom strategy to your API routes using Passport's middleware. Make sure to set session: false since we're not using sessions.

const express = require('express');
const router = express.Router();

// Protect all routes under /api with our custom strategy
router.use('/api', passport.authenticate('app-uuid-auth', { session: false }));

// Example protected API route
router.get('/api/protected-data', (req, res) => {
  res.json({ message: "This data is only accessible to your React Native app!" });
});

4. Configure React Native to Send Required Headers #

In your React Native app, you'll need to send the device UUID and app secret with every API request. Use a library like react-native-device-info to get the device's unique ID.

First install the library:

npm install react-native-device-info

Then set up an API client that automatically includes the headers:

import DeviceInfo from 'react-native-device-info';
import axios from 'axios'; // Or use fetch, axios is just easier for interceptors

// Get the device's unique UUID
const deviceUuid = DeviceInfo.getUniqueId();

// Your app secret (match the one in your backend's environment variables)
// Note: Don't hardcode this! Use a secure method like react-native-config to inject it at build time
const APP_SECRET = process.env.YOUR_APP_SECRET;

// Create an axios instance that adds the required headers to every request
const apiClient = axios.create({
  baseURL: 'https://your-backend-domain.com',
  headers: {
    'x-device-uuid': deviceUuid,
    'x-app-secret': APP_SECRET
  }
});

// Use this client for all API calls
apiClient.get('/api/protected-data')
  .then(response => console.log(response.data))
  .catch(error => console.error("Request failed:", error));

• Never hardcode secrets: Use environment variables for both your backend and React Native app (tools like react-native-config help with RN).
• Add request signing: To prevent replay attacks or secret interception, generate a unique signature for each request (e.g., hash the UUID + timestamp + app secret) and validate it on the backend.
• Rate limiting: Add a rate limiter (like express-rate-limit) to your backend to block excessive requests, even from valid devices.
• UUID caveats: On Android, a device's UUID might change after a factory reset, but since you don't need persistent user identity, this shouldn't be an issue for your use case.

内容的提问来源于stack exchange，提问作者Chen Doron