我正在尝试使用Passport在我的应用程序中实现摘要身份验证,但遇到了以下问题,无法解决。
当我按如下方式卷曲“受保护的网址”时,收到400-错误的请求响应:
$curl --user test:123456 --digest http://localhost:3000/users
您可以在末尾找到完整的卷曲请求/响应。
我尝试使用自定义回调,passport.authenticate
以查看得到了什么:
users.get('/', function(req, res, next) {
passport.authenticate('digest', {session: false}, function(err, user, info) {
console.log('Err: %s', err);
console.log('User: %s', user);
console.log('Info: %s', info);
})(req, res, next);
}, otherMiddleware);
结果是:
Err: null
User: false
Info: Digest realm="Users", nonce="YTFqg2z17mYU039DvuLzONN48F0q1Xmk", qop="auth"
因此,我认为未正确发送用户,但无法弄清楚原因。
我已将护照配置为使用摘要身份验证,如下所示:
index.js:
// ...
var passport = require('passport);
var usersRoute = require('./routes/users');
// ...
app.use(passport.initialize());
app.use('/users', usersRoute);
users.js
var passport = require('passport'),
DigestStrategy = require('passport-http').DigestStrategy,
User = require('../../models/users');
passport.use(new DigestStrategy({qop: 'auth'},function(username, done) {
User.findOne({username: username}, function (err, user) {
if (err) {return done(err);}
if (!user) {return done(null, false);}
return done(null, user, user.password);
});
}));
users.get('/', passport.authenticate('digest', {session: false}), function(req, res) {
res.send('Hi!');
});
然后,当我尝试:
$curl --user test:123456 --digest http://localhost:3000/users
我收到“ 400-错误的请求”响应。
我留下了带有-v选项的curl命令的完整输出。
Eileen :: ~ » curl -v --user test:123456 --digest http://localhost:3000/users
* Adding handle: conn: 0x7f858b803a00
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7f858b803a00) send_pipe: 1, recv_pipe: 0
* About to connect() to localhost port 3000 (#0)
* Trying ::1...
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 3000 (#0)
* Server auth using Digest with user 'test'
> GET /users HTTP/1.1
> User-Agent: curl/7.30.0
> Host: localhost:3000
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< X-Powered-By: Express
< WWW-Authenticate: Digest realm="Users", nonce="Ah0vZigHMrDx6SMcA3cMeaFm46RtYmv9", qop="auth"
< Date: Wed, 18 Jun 2014 11:13:58 GMT
< Connection: keep-alive
< Transfer-Encoding: chunked
<
* Ignoring the response-body
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:3000/users'
* Found bundle for host localhost: 0x7f858b4151c0
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 3000 (#0)
* Adding handle: conn: 0x7f858b803a00
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7f858b803a00) send_pipe: 1, recv_pipe: 0
* Server auth using Digest with user 'test'
> GET /users HTTP/1.1
> Authorization: Digest username="test", realm="Users", nonce="Ah0vZigHMrDx6SMcA3cMeaFm46RtYmv9", uri="/users", cnonce="ICAgICAgICAgICAgICAgICAgICAgIDE0MDMyNjc5MTY=", nc=00000001, qop=auth, response="7c7d3c5bb1b8882915d3ffe1a2b0231c"
> User-Agent: curl/7.30.0
> Host: localhost:3000
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< X-Powered-By: Express
< Date: Wed, 18 Jun 2014 11:13:58 GMT
< Connection: keep-alive
< Transfer-Encoding: chunked
<
* Connection #0 to host localhost left intact
Bad Request%
我遇到了类似的问题,并且在我们两个案例中都认为问题在于,passport-http不适用于已挂载的应用程序。
有一个开放的拉取请求https://github.com/jaredhanson/passport-http/pull/16,如果可以通过CI构建,则可以修复该错误。
一种解决方法是仅删除Express路由器实例,并传递应用程序实例以将所有端点直接安装在应用程序对象上。
本文收集自互联网,转载请注明来源。
如有侵权,请联系[email protected] 删除。
我来说两句