node.js - 如何保护nodejs中的公共动态文件夹

Question

我在 public/images/picture.jpg 中显示带有翡翠的图片，但我想保护一些图片或限制对公共文件夹的访问怎么做？

project
    node_modules
    public
        images
            image.jpg
        javascripts
        stylesheets
        protected_folder*
            image_protected.jpg
    views

Answer 1

注意：对于所有这些示例，我使用的应用程序结构如下：

.
├── app.js
└── public
    ├── protected
    │   └── file.txt  <-- contains text "protected file"
    └── regular
        └── file.txt  <-- contains text "regular file"

---

你有几个选择。最简单的一种是让 Express在公共中间件之前通过您的路由器路由请求，允许您拦截请求：

var express = require('express');
var http = require('http');
var path = require('path');

var app = express();

// use app.router before express.static
app.use(app.router);
app.use(express.static(path.join(__dirname, 'public')));

function userIsAllowed(callback) {
  // this function would contain your logic, presumably asynchronous,
  // about whether or not the user is allowed to see files in the
  // protected directory; here, we'll use a default value of "false"
  callback(false);
};

app.get('/', function(req, res, next) {
  res.end('Home page');
});

app.get('/protected/*', function(req, res, next) {
  userIsAllowed(function(allowed) {
    if (allowed) {
      next(); // call the next handler, which in this case is express.static
    } else {
      res.end('You are not allowed!');
    }
  });
});

http.createServer(app).listen(3000, function(){
  console.log('Express server listening on port 3000');
});

结果：

http://localhost:3000/regular/file.txt # regular file
http://localhost:3000/protected/file.txt # You are not allowed!

这种方法的问题是，在提供静态文件之前，请求必须一直通过应用程序的路由器，这不是很有效，但可能满足您的需求（您需要采取一些测量并自己找出来）。

---

另一种选择是在中间件链中插入一个小功能，该功能基本相同，但不需要运行整个应用程序路由器：

var express = require('express');
var http = require('http');
var path = require('path');

function userIsAllowed(callback) {
  // this function would contain your logic, presumably asynchronous,
  // about whether or not the user is allowed to see files in the
  // protected directory; here, we'll use a default value of "false"
  callback(false);
};

// This function returns a middleware function
var protectPath = function(regex) {
  return function(req, res, next) {
    if (!regex.test(req.url)) { return next(); }

    userIsAllowed(function(allowed) {
      if (allowed) {
        next(); // send the request to the next handler, which is express.static
      } else {
        res.end('You are not allowed!');
      }
    });
  };
};

var app = express();

app.use(protectPath(/^\/protected\/.*$/));
app.use(express.static(path.join(__dirname, 'public')));

app.get('/', function(req, res, next) {
  res.end('Home page');
});

http.createServer(app).listen(3000, function(){
  console.log('Express server listening on port 3000');
});

这执行基本相同的逻辑，但不是通过整个应用路由器路由每个请求，而是在每个请求的开头运行一个小函数，检查请求的 URL 是否与您传入的正则表达式匹配。如果匹配，它运行检查以查看用户是否可以访问该文件。

结果：

http://localhost:3000/regular/file.txt # regular file
http://localhost:3000/protected/file.txt # You are not allowed!