Node.js ssh2开发SFTP网页客户端：每次sftp.read需重复登录问题

Hey there! I’ve run into this exact headache before building SFTP web clients with the ssh2 package. The core issue here is that you’re spinning up a brand new SFTP connection every time you trigger an AJAX directory read—let’s fix this by keeping authenticated connections alive across user requests.

Here are the most practical, battle-tested approaches:

1. Store SFTP Connections in User Sessions (Single Server Setup) #

If you’re running a single server (like an Express app), use session storage to persist the SFTP connection after the user logs in. This way, every subsequent request reuses the existing authenticated connection.

Step-by-Step Implementation: #

• First, set up session middleware (e.g., express-session for Express):

  const session = require('express-session');
  app.use(session({
    secret: 'your-secure-secret-key',
    resave: false,
    saveUninitialized: false,
    cookie: { secure: true, maxAge: 3600000 } // 1-hour session timeout
  }));
  

• When the user logs in, establish the SFTP connection and store the connected instance in their session:

  const { Client } = require('ssh2');
  
  app.post('/api/sftp/login', async (req, res) => {
    const { host, username, password } = req.body;
    const conn = new Client();
  
    try {
      await new Promise((resolve, reject) => {
        conn.on('ready', resolve)
          .on('error', reject)
          .connect({ host, username, password });
      });
  
      // Store the active SFTP and SSH connection in the session
      req.session.sftp = await conn.sftp();
      req.session.sshConn = conn;
      res.json({ success: true, message: 'Connected to SFTP server' });
    } catch (err) {
      res.status(500).json({ success: false, error: err.message });
    }
  });
  

• For directory read requests, pull the existing SFTP instance from the session instead of re-authenticating:

  app.get('/api/sftp/browse', async (req, res) => {
    if (!req.session.sftp) {
      return res.status(401).json({ error: 'Please log in first' });
    }
  
    try {
      const targetDir = req.query.path || '/';
      const directoryContents = await req.session.sftp.readdir(targetDir);
      res.json({ files: directoryContents });
    } catch (err) {
      // Handle connection drops (e.g., trigger re-login flow)
      res.status(500).json({ error: err.message, needsReauth: true });
    }
  });
  

• Add cleanup logic to close connections when sessions expire or users log out:

  app.post('/api/sftp/logout', (req, res) => {
    if (req.session.sshConn) {
      req.session.sshConn.end();
    }
    req.session.destroy();
    res.json({ success: true });
  });
  

2. Use a Connection Pool (Multi-User / Scalable Setup) #

For apps with multiple concurrent users or distributed servers, a connection pool is more efficient. It reuses existing connections instead of creating new ones for every request.

Basic Pool Implementation: #

• Create a pool to manage SFTP connections, keyed by a unique user session ID:

  const { Client } = require('ssh2');
  const sftpPool = new Map(); // Key: sessionId, Value: { sshConn, sftp }
  
  // Helper to get or create a connection
  async function getSftpConnection(sessionId, authDetails) {
    if (sftpPool.has(sessionId)) {
      const { sshConn, sftp } = sftpPool.get(sessionId);
      // Check if the connection is still active
      if (sshConn._events.ready) {
        return sftp;
      }
      // Remove dead connections from the pool
      sftpPool.delete(sessionId);
    }
  
    // Create a new connection if none exists or the old one died
    const sshConn = new Client();
    await new Promise((resolve, reject) => {
      sshConn.on('ready', resolve)
        .on('error', reject)
        .connect(authDetails);
    });
    const sftp = await sshConn.sftp();
    sftpPool.set(sessionId, { sshConn, sftp });
    return sftp;
  }
  

• In your directory browse route, use this helper to fetch an existing connection:

  app.get('/api/sftp/browse', async (req, res) => {
    const sessionId = req.headers['x-session-id'];
    if (!sessionId) {
      return res.status(401).json({ error: 'No session ID provided' });
    }
  
    try {
      // Fetch user auth details from your secure store (e.g., database)
      const authDetails = await getUserAuthBySession(sessionId);
      const sftp = await getSftpConnection(sessionId, authDetails);
      const directoryContents = await sftp.readdir(req.query.path || '/');
      res.json({ files: directoryContents });
    } catch (err) {
      res.status(500).json({ error: err.message });
    }
  });
  

• Pro Tip: Add an interval to clean up idle/dead connections in the pool to prevent memory leaks:

  setInterval(() => {
    for (const [sessionId, { sshConn }] of sftpPool.entries()) {
      if (!sshConn._events.ready) {
        sftpPool.delete(sessionId);
      }
    }
  }, 300000); // Clean up every 5 minutes
  

3. Critical Best Practices #

• Security: Never store plaintext credentials in sessions or client-side storage. Use encrypted session stores (like Redis with encryption) or fetch credentials from a secure database only when needed.
• Connection Resilience: Add logic to detect dropped connections and either auto-reconnect (if credentials are stored securely) or prompt the user to re-login.
• Memory Management: Always close connections when they’re no longer needed (user logout, session expiration) to avoid resource leaks.

内容的提问来源于stack exchange，提问作者Ronny Brandt