node.js - FeathersJS 使用客户端证书进行身份验证

Question

我正在尝试创建自己的身份验证策略，该策略在 FeathersJS 后端读取客户端的 PKI 证书。这是在 before Hook 中处理的，并且基于文档 Hook 是

A hook is transport independent, which means it does not matter if it has been called through HTTP(S) (REST), Socket.io, Primus or any other transport Feathers may support in the future. They are also service agnostic, meaning they can be used with ​any​ service regardless of whether they have a model or not.

这不是一个坏主意，但是我需要钩子(Hook)中的 TLS 套接字结构来获取用户的证书。本质上是调用:req.socket.getPeerCertificate()。我正在使用 passport-client-certificate 模块，这是有问题的策略:

class ClientCertStrategy extends Strategy {
  constructor (options, verify) {
    if (typeof options === 'function') {
      verify = options
      options = {}
    }
    if (!verify) throw new Error('Client cert authentication strategy requires a verify function')

    super()

    this.name = 'client-cert'
    this._verify = verify
    this._passReqToCallback = options.passReqToCallback
  }

  _verified (err, user) {
    if (err) { return this.error(err) }
    if (!user) { return this.fail() }
    this.success(user)
  }

  authenticate (req, options) {
    // Requests must be authorized
    // (i.e. the certificate must be signed by at least one trusted CA)
    if (!req.socket.authorized) {
      this.fail()
      return
    }

    // This is where it fails! req.socket does not exist
    const clientCert = req.socket.getPeerCertificate()

    if (!clientCert) {
      this.fail()
      // TODO: Failure message
      // this.fail({message: options.badRequestMessage || 'Missing client     certificate'}, 400)
      return
    }

    try {
      if (this._passReqToCallback) {
        this._verify(req, clientCert, this._verified.bind(this))
      } else {
        this._verify(clientCert, this._verified.bind(this))
      }
    } catch (err) {
      return this.error(err)
    }
  }
}

基于 FeathersJS 代码，authenticate 函数基本上从 hook 生成一个新的请求对象。有什么办法可以提前获取用户的证书并在稍后执行 Hook 时使其可用吗？

Answer 1

我写了一个问题，并被指出了常见问题解答，它最终帮助我解决了这个问题:

https://github.com/feathersjs/authentication/issues/693

https://docs.feathersjs.com/faq/readme.html#how-do-i-access-the-request-object-in-hooks-or-services

我最终编写了一个中间件，将证书粘贴到请求params中。请求params 被复制到钩子(Hook)中，然后传递到 Passport 策略中。