Question

我正在创建在线课程申请，我希望只有经过身份验证的用户才能查看课程详情和课程讲座。我正在使用本地护照身份验证策略进行用户身份验证。我在我的路由中添加了isAuthenticated，但是，未经身份验证的用户仍然可以查看视频讲座。这是我的路线文件。文件名： - courses.server.routes.js

'use strict';

/**
* Module dependencies
*/
var path = require('path'),
mongoose = require('mongoose'),
Course = mongoose.model('Course'),
errorHandler = require(path.resolve('./modules/core/server/controllers/errors.server.controller'));
var passport = require('passport');

/**
* Create an course
*/
exports.create = function (req, res) {
var course = new Course(req.body);
course.user = req.user;

course.save(function (err) {
if (err) {
  return res.status(422).send({
    message: errorHandler.getErrorMessage(err)
  });
} else {
  res.json(course);
}
});
};

/**
* Show the current course
*/
exports.read = function (req, res) {
// convert mongoose document to JSON
var course = req.course ? req.course.toJSON() : {};

// Add a custom field to the Course, for determining if the current User is the "owner".
// NOTE: This field is NOT persisted to the database, since it doesn't exist in the Course model.
course.isCurrentUserOwner = !!(req.user && course.user && course.user._id.toString() === req.user._id.toString());

console.log('course value is: ' + course);
console.log('video lecture embed value is: ' + course.courseLecture.lecture_video);

res.json(course);
};

/**
* Update an course
*/
exports.update = function (req, res) {
var course = req.course;

course.title = req.body.title;
course.content = req.body.content;
course.courseLecture.lecture_video =  req.body.courseLecture.lecture_video;
console.log('course lecture video url is: ' + req.body.courseLecture.lecture_video);
course.save(function (err) {
if (err) {
  return res.status(422).send({
    message: errorHandler.getErrorMessage(err)
  });
} else {
  res.json(course);
}
});
};

/**
* Delete an course
*/
exports.delete = function (req, res) {
var course = req.course;

course.remove(function (err) {
if (err) {
  return res.status(422).send({
    message: errorHandler.getErrorMessage(err)
  });
} else {
  res.json(course);
}
});
};

/**
* List of Courses
*/
exports.list = function (req, res) {
Course.find().sort('-created').populate('user',  'displayName').exec(function (err, courses) {
if (err) {
  return res.status(422).send({
    message: errorHandler.getErrorMessage(err)
  });
} else {
  res.json(courses);
}
});
};

/**
* Course middleware
*/
exports.courseByID = function (req, res, next, id) {

if (!mongoose.Types.ObjectId.isValid(id)) {
return res.status(400).send({
  message: 'Course is invalid'
});
}

Course.findById(id).populate('user', 'displayName').exec(function (err, course) {
if (err) {
  return next(err);
} else if (!course) {
  return res.status(404).send({
    message: 'No course with that identifier has been found'
  });
}
req.course = course;
next();
});
};

这是我的路由控制器文件。文件名： - courses.server.controller.js

{{1}}

我无法弄明白，这里出了什么问题。

Answer 1

来自isAuthenticated动词的http函数来自get, post, patch, delete

像：

app.route('/api/courses/:courseId')
 .get(isAuthenticated, courses.read)

isAuthenticated也可以写入另一个文件并在路线中使用

Can see this example

isAuthenticated（）函数不能正常工作node.js护照

1 个答案: