如何在Node.js+Express中为集成的Agendash做身份认证？

Hey there, let's get your Agendash integration secured and working smoothly with your existing JWT auth setup. Here's a step-by-step breakdown tailored to your stack:

1. 编写管理员权限校验中间件 #

First, we'll build a middleware that checks both the validity of the JWT token and whether the user has admin privileges. This ties directly into your existing auth system:

const jwt = require('jsonwebtoken');
const User = require('./models/User'); // 替换成你的用户模型实际路径

// 管理员权限校验中间件
const requireAdmin = async (req, res, next) => {
  try {
    // 从Authorization头提取JWT令牌（假设格式为Bearer <token>）
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ message: '请提供有效的身份令牌' });
    }
    const token = authHeader.split(' ')[1];

    // 验证令牌有效性
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    // 查询用户并检查管理员权限
    const user = await User.findById(decoded.userId);
    if (!user || !user.isAdmin) {
      return res.status(403).json({ message: '无管理员访问权限' });
    }

    // 验证通过，将用户信息挂载到请求对象供后续使用
    req.user = user;
    next();
  } catch (error) {
    return res.status(401).json({ message: '令牌无效或已过期' });
  }
};

2. 给Agendash路由添加权限校验 #

Update your existing Agendash setup to use the requireAdmin middleware before serving Agendash. This ensures only authenticated admins can access the dashboard:

const agenda = new Agenda({ db: { address: config.get("DBUrl") } });
// 先校验管理员权限，再挂载Agendash路由
app.use('/agenda', requireAdmin, Agendash(agenda));

3. 前端iframe集成与令牌传递 #

Since you're using an iframe to embed Agendash, the most secure and straightforward way to pass the JWT token is to store it in an HttpOnly, SameSite cookie. When your admin users log in, set the cookie like this:

// 用户登录成功后设置JWT cookie
res.cookie('jwt', token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production', // 生产环境启用HTTPS
  sameSite: 'strict',
  maxAge: 24 * 60 * 60 * 1000 // 24小时有效期
});

Then, your frontend iframe can simply point to the /agenda route—since it's same-origin, the cookie will automatically be included in all requests to Agendash:

<!-- 管理界面中的iframe代码 -->
<iframe 
  src="/agenda" 
  width="100%" 
  height="90vh" 
  frameborder="0"
  title="Agendash 任务调度管理"
></iframe>

4. 增强iframe安全性 #

Add a middleware to set the X-Frame-Options header, which prevents external sites from embedding your Agendash dashboard:

app.use((req, res, next) => {
  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
  next();
});

额外注意事项 #

• If you're currently storing JWT in localStorage instead of cookies, you'll need a workaround (like using postMessage to pass the token to the iframe, then modifying Agendash's request handlers to include it). But switching to HttpOnly cookies is strongly recommended for security.
• Make sure your Agenda instance is properly initialized and connected to your database before mounting Agendash—you might want to add await agenda.start() if you haven't already.

内容的提问来源于stack exchange，提问作者LandoR