angularjs - 使用 angularjs 时如何仅在 Meanjs 中保护经过身份验证的用户的功能

Question

我正在开发我的第一个应用程序，并已从前端和 angularjs 开始。总的来说，我发现它非常直观，但后端和前端之间的关系对我来说开始变得模糊。

我现在已经达到了这样的程度:我想在某些页面上提供稍微不同的功能，具体取决于用户是否经过身份验证(在本例中是编辑表单中某些表单字段的能力)。

从公共(public) angularjs 方面来看，编写基本的 if 语句来为经过身份验证的用户提供不同的功能(请参阅下面的基本尝试)似乎很容易，但由于这是一个客户端功能，我如何防止用户欺骗身份验证来编辑我不希望他们做的事情(保存到数据库)。

angular.module('core').controller('myCtrl', ['$scope', 'Authentication', 'Menus',
    function($scope, Authentication, Menus) {
        $scope.authentication = Authentication;

        if(typeof $scope.authentication.user == "object"){
           // behaviour for authenticated
        }else{
          // for unauthenticated
        }
    }

我对mean、meanjs和node.js总体来说还是个新手，主要是一个php人，所以如果我的问题离题太远，请保持温和。

Answer 1

我建议使用 Passport 和 npm 模块进行用户身份验证。这里有一些代码可以帮助您入门。另请看看这个scotch.io tutorial

// load all the things we need
var LocalStrategy   = require('passport-local').Strategy;

// load up the user model
var User            = require('../app/models/user');

// expose this function to our app using module.exports
module.exports = function(passport) {

passport.serializeUser(function(user, done) {
done(null, user.id);
});

// used to deserialize the user
passport.deserializeUser(function(id, done) {
User.findById(id, function(err, user) {
  done(err, user);
  });
});


passport.use('local-signup', new LocalStrategy({
usernameField : 'email',
passwordField : 'password',
passReqToCallback : true // allows us to pass back the entire request         to the callback
 },
   function(req, email, password, done) {

// asynchronous
// User.findOne wont fire unless data is sent back
process.nextTick(function() {

  // find a user whose email is the same as the forms email
  // we are checking to see if the user trying to login already exists
  User.findOne({ 'local.email' :  email }, function(err, user) {
    // if there are any errors, return the error
    if (err)
      return done(err);

    // check to see if theres already a user with that email
    if (user) {
      return done(null, false, req.flash('signupMessage', 'That email  is already taken.'));
    } else {

      // if there is no user with that email
      // create the user
      var newUser            = new User();

      // set the user's local credentials
      newUser.local.email    = email;
      newUser.local.password = newUser.generateHash(password);

      // save the user
      newUser.save(function(err) {
        if (err)
          throw err;
        return done(null, newUser);
      });
    }

  });

});

 }));

  passport.use('local-login', new LocalStrategy({
// by default, local strategy uses username and password, we will override with email
usernameField : 'email',
passwordField : 'password',
passReqToCallback : true // allows us to pass back the entire request to the callback
  },
   function(req, email, password, done) { // callback with email and password from our form

// find a user whose email is the same as the forms email
// we are checking to see if the user trying to login already exists
User.findOne({ 'local.email' :  email }, function(err, user) {
  // if there are any errors, return the error before anything else
  if (err)
    return done(err);

  // if the user is found but the password is wrong
  if (!user || !user.validPassword(password))
    return done(null, false, req.flash('loginMessage', 'Oops! Wrong username or password.')); // create the loginMessage and save it to session as flashdata

  // all is well, return successful user
  return done(null, user);
});

 }));

};