node.js 了解护照序列化反序列化

Understanding passport serialize deserialize

提问by Anubhav

How would you explain the workflow of Passport's serialize and deserialize methods to a layman.

您如何向外行解释 Passport 的序列化和反序列化方法的工作流程。

1. Where does user.idgo after passport.serializeUserhas been called?
   

2. We are calling passport.deserializeUserright after it where does it fit in the workflow?

   // used to serialize the user for the session
   passport.serializeUser(function(user, done) {
       done(null, user.id); 
      // where is this user.id going? Are we supposed to access this anywhere?
   });
   
   // used to deserialize the user
   passport.deserializeUser(function(id, done) {
       User.findById(id, function(err, user) {
           done(err, user);
       });
   });
   

1. 被调用user.id后去哪里passport.serializeUser？
   

2. 我们passport.deserializeUser在它之后调用它在工作流程中的哪个位置？

   // used to serialize the user for the session
   passport.serializeUser(function(user, done) {
       done(null, user.id); 
      // where is this user.id going? Are we supposed to access this anywhere?
   });
   
   // used to deserialize the user
   passport.deserializeUser(function(id, done) {
       User.findById(id, function(err, user) {
           done(err, user);
       });
   });
   

I'm still trying to wrap my head around it. I have a complete working app and am not running into errors of any kind.

我仍然试图绕过它。我有一个完整的工作应用程序，并且没有遇到任何类型的错误。

I just wanted to understand what exactly is happening here?

我只是想了解这里到底发生了什么？

Any help is appreciated.

任何帮助表示赞赏。

回答by A.B

1. Where does user.idgo after passport.serializeUserhas been called?

1. 被调用user.id后去哪里passport.serializeUser？

The user id (you provide as the second argument of the donefunction) is saved in the session and is later used to retrieve the whole object via the deserializeUserfunction.

用户 ID（您作为done函数的第二个参数提供）保存在会话中，稍后用于通过deserializeUser函数检索整个对象。

serializeUserdetermines which data of the user object should be stored in the session. The result of the serializeUser method is attached to the session as req.session.passport.user = {}. Here for instance, it would be (as we provide the user id as the key) req.session.passport.user = {id: 'xyz'}

serializeUser确定用户对象的哪些数据应该存储在会话中。serializeUser 方法的结果作为 附加到会话req.session.passport.user = {}。例如，这里是（因为我们提供用户 ID 作为密钥）req.session.passport.user = {id: 'xyz'}

2. We are calling passport.deserializeUserright after it where does it fit in the workflow?

2. 我们passport.deserializeUser在它之后调用它在工作流程中的哪个位置？

The first argument of deserializeUsercorresponds to the key of the user object that was given to the donefunction (see 1.). So your whole object is retrieved with help of that key. That key here is the user id (key can be any key of the user object i.e. name,email etc). In deserializeUserthat key is matched with the in memory array / database or any data resource.

的第一个参数deserializeUser对应于赋予done函数的用户对象的键（参见 1.）。所以你的整个对象是在那个键的帮助下检索的。此处的键是用户 ID（键可以是用户对象的任何键，例如姓名、电子邮件等）。在deserializeUser该键与在存储器阵列/数据库或任何数据资源相匹配。

The fetched object is attached to the request object as req.user

获取的对象附加到请求对象作为 req.user

Visual Flow

视觉流

passport.serializeUser(function(user, done) {
    done(null, user.id);
});              │
                 │ 
                 │
                 └─────────────────┬──→ saved to session
                                   │    req.session.passport.user = {id: '..'}
                                   │
                                   ↓           
passport.deserializeUser(function(id, done) {
                   ┌───────────────┘
                   │
                   ↓ 
    User.findById(id, function(err, user) {
        done(err, user);
    });            └──────────────→ user object attaches to the request as req.user   
});

回答by yvanscher

For anyone using Koa and koa-passport:

对于使用 Koa 和koa-passport 的任何人：

Know that the key for the user set in the serializeUser method (often a unique id for that user) will be stored in:

知道在 serializeUser 方法中设置的用户密钥（通常是该用户的唯一 ID）将存储在：

this.session.passport.user

this.session.passport.user

When you set in done(null, user)in deserializeUser where 'user' is some user object from your database:

当您done(null, user)在 deserializeUser 中设置其中“用户”是数据库中的某个用户对象时：

this.req.userOR this.passport.user

this.req.user或者 this.passport.user

for some reason this.userKoa context never gets set when you call done(null, user) in your deserializeUser method.

出于某种原因，this.user当您在 deserializeUser 方法中调用 done(null, user) 时，Koa 上下文永远不会设置。

So you can write your own middleware after the call to app.use(passport.session()) to put it in this.user like so:

因此，您可以在调用 app.use(passport.session()) 之后编写自己的中间件，将其放入 this.user 中，如下所示：

app.use(function * setUserInContext (next) {
  this.user = this.req.user
  yield next
})

If you're unclear on how serializeUser and deserializeUser work, just hit me up on twitter. @yvanscher

如果您不清楚 serializeUser 和 deserializeUser 的工作方式，请在 twitter 上联系我。@yvanscher