如何使页面仅在使用express＆ejs登录时可访问

页面仅在使用express＆ejs登录时可访问"/>

如何使页面仅在使用express＆ejs登录时可访问

目前，我正在为一个虚拟的登录/注册页面开发一个小项目，现在我想添加一个仅在您登录后才可以访问的页面。所以问题是如何创建会话或cookie，找回他们？以及如何阻止未登录的用户。

我目前正在为app.js使用此代码

var createError = require('http-errors');
var express = require('express');
var path = require('path');
var cookieParser = require('cookie-parser');
var logger = require('morgan');
var mongoose = require('mongoose');
var expressSession = require('express-session');
var passport = require('passport');
var LocalStrategy = require('passport-local').Strategy;
var AuthTokenStrategy = require('passport-auth-token').Strategy;
require('./models');

var User = mongoose.model('User')

mongoose.connect('mongodb://localhost:27017/my-data', { useNewUrlParser: true, useUnifiedTopology: true })

var app = express();

// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'ejs');

app.use(logger('dev'));
app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(cookieParser());
app.use(express.static(path.join(__dirname, 'public')));

passport.use(new LocalStrategy({
  usernameField: "key"
}, function(key, next) {
  User.findOne({
    key: key
  }, function(err, user) {
    if (err) return next(err);
    if (!user) {
      return next({message: 'Key incorrect'})
    }
    next(null, user);
  })
}));

passport.serializeUser(function (user, next) {
  next(null, user._id)
})

passport.deserializeUser(function (id, next){
  User.findById(id, function (err, user) {
    next(err, user);
  });
});

app.use(passport.initialize());

app.use(passport.session());



app.use(expressSession({
  secret: 'aksndklajsdjicpwoemcklnaiohdandascopkqpowdmklasmdiojqwndjkasndosiqjwdklnasaksndklajsdjicpwoemcklnaiohdandascopkqpowdmklasmdiojqwndjkasndosiqjwdklnas'
}))

app.get('/', function(req, res, next){
  res.render('index', {title: 'MySite'})
});

app.get('/main', function(req, res, next){
  res.render('main')
});

app.get('/login', function(req, res, next){
  res.render('login')
});



app.post('/signup', function(req, res, next){
  User.findOne({
    key: req.body.key
  }, function (err, user) {
      if (err) return next(err)
      if (user) return next({message: 'This client exists'})
    let newUser = new User({
      key: req.body.key
    });
    newUser.save(function(err) {
      if (err) return next(err);
      res.redirect('/main');
    });
  console.log(req.body)
  });
});

app.post('/login', async (req, res, next) => {
  const key = req.body.key;
  //const ip = req.header('x-forwarded-for') || req.connection.remoteAddress;

  //console.log(ip);

  if (!key) return res.status(401).json({ err: 'Key not provided' });

  const User = mongoose.model('User');

  const user = await User.findOne({ key }).exec();

  if (!user) return res.status(401).json({ err: 'Invalid Key' });

  res.redirect('/main');
});

// error handler
app.use(function(err, req, res, next) {
  // set locals, only providing error in development
  res.locals.message = err.message;
  res.locals.error = req.app.get('env') === 'development' ? err : {};

  // render the error page
  res.status(err.status || 500);
  res.render('error');
});

module.exports = app;

尝试将此中间件添加到受保护的路由：

function isAuthenticated(req,res,next){
  if(req.isAuthenticated()){ // will return true if user is logged in
      next();
  } else{
      res.redirect("/login");
  }
}

app.get('/protectedPath',isAuthenticated, function(req,res) {
   //protected content
);