node.js中实现双重身份验证机制的方法详解

npm install express speakeasy

const express = require('express');
const app = express();

app.use(express.json());
app.use(express.static('public'));
app.listen(3000, () => {
  console.log('Server started on port 3000');
});

const users = [];

class User {
  constructor(id, name, email, password, secret) {
    this.id = id;
    this.name = name;
    this.email = email;
    this.password = password;
    this.secret = secret;
  }
}
module.exports = { users, User };

const { users, User } = require('./user');
const speakeasy = require('speakeasy');
const QRCode = require('qrcode');

app.post('/register', (req, res) => {
  const { name, email, password } = req.body;
  // 为用户生成新的密钥
  const secret = speakeasy.generateSecret({ length: 20 });
  // 保存用户数据
  const user = new User(users.length + 1, name, email, password, secret.base32);
  users.push(user);
  // 生成一个二维码供用户扫描
  QRCode.toDataURL(secret.otpauth_url, (err, image_data) => {
    if (err) {
      console.error(err);
      return res.status(500).send('Internal Server Error');
    }
    res.send({ qrCode: image_data });
  });
});

const { users } = require('./user');
const speakeasy = require('speakeasy');

app.post('/login', (req, res) => {
  const { email, password, token } = req.body;
  const user = users.find(u => u.email === email);
  // 验证用户的凭证
  if (!user || user.password !== password) {
    return res.status(401).send('Invalid credentials');
  }
  // 核实用户的令牌
  const verified = speakeasy.totp.verify({
    secret: user.secret,
    encoding: 'base32',
    token,
    window: 1
  });
  if (!verified) {
    return res.status(401).send('Invalid token');
  }
  // 用户经过认证
  res.send('Login successful');
});

const speakeasy = require('speakeasy');

exports.requireToken = (req, res, next) => {
  const { token } = req.body;
  // Find the user with the given email address
  const user = users.find(u => u.email === req.user.email);
  // Verify the user's token
  const verified = speakeasy.totp.verify({
    secret: user.secret,
    encoding: 'base32',
    token,
    window: 1
  });
  if (!verified) {
    return res.status(401).send('Invalid token');
  }
  // 令牌有效,继续到下一个中间件或路由处理程序
  next();
}

app.post('/protected', requireToken, (req, res) => {
  // 只有当用户的令牌有效时才会调用此路由处理程序
  res.send('Protected resource accessed successfully');
});