koa-passport w/passport-steam: ctx.isAuthenticated() 总是假的

Question

我正在使用 koa-passport 和 passport-steam 来验证具有 SteamID 的用户。尽管通过 Steam 正确登录，ctx.isAuthenticated() 始终为 false。我一直在查看许多其他 SO 问题和指南以及谷歌搜索结果，这个问题很常见，但总是由于某些不适用于我的代码中的特殊错误。显然还有其他一些特殊的问题困扰着我的代码，但我找不到它。 大多数与护照相关的代码实际上是从教程/文档/示例中复制粘贴的。我的中间件有正确的顺序，据我所知，这不是会话配置问题。

const Koa = require("koa");
const session = require("koa-session");
const Router = require("@koa/router");
const views = require("koa-views");
const passport = require("koa-passport");
const SteamStrategy = require("passport-steam").Strategy;
const bodyparser = require("koa-bodyparser");

const root = "http://localhost:3000";
const app = new Koa();
const router = new Router();

passport.serializeUser((user, done) => {
    console.log("Serializing:", user);
  done(null, user);
});

passport.deserializeUser((obj, done) => {
    console.log("Deserializing:", obj);
  done(null, obj);
});

passport.use("steam", new SteamStrategy({
        returnURL: root + "/auth/steam/return",
        realm: root,
        apiKey: "---"
    },
    function(identifier, profile, done) {
        process.nextTick(function () {
            let identifie = identifier.match(/\/id\/(\d+)/)[1];
            profile.id = identifie
            console.log("Returned from Steam:", profile);
            return done(null, profile);
        });
    })
);

app.on("ready", () => {
    console.log('ready');
});

app.on("error", (err, ctx) => {
    console.log("ERR:", err);
});

const CONFIG = {
    key: 'koa.sess',
    maxAge: 10000,
    secure: true
} 
//I have tried tons of cookie settings including using default
//because a lot of people in the koa-passport issues seem to have solved
//their similar problem by changing session settings, but I've had no such luck
app.keys = ['session_secret'];
app.use(session(CONFIG, app));
app.use(bodyparser());
app.use(passport.initialize());
app.use(passport.session());

app.use(views("views", { 
            map: { 
                ejs: "ejs" 
            }
        })
);

//A shoddy attempt at middleware just to test. But ctx.isAuthenticated always returns false.
app.use(async (ctx, next) => {
    if (ctx.isAuthenticated()) {
        console.log("Hey! You're authenticated");
    }
    return next()
});

app.use(router.routes());


router.get("/", async (ctx, next) => {
    await ctx.render("howdy.ejs");
});

router.get("/auth/steam", async (ctx, next) => {
    console.log("Trying to auth");  
    return passport.authenticate('steam', { failureRedirect: "/fail" })(ctx);
});

router.get("/auth/steam/return", async (ctx, next) => {
    passport.authenticate('steam', { failureRedirect: "/fail", successRedirect: "/text" })(ctx);
    ctx.redirect("/text");
});

router.get("/fail", async (ctx, next) => {
    await ctx.render("fail.ejs");
});

router.get("/text", async (ctx, next) => {
    console.log(`
    Auth: ${ctx.isAuthenticated()},
    Unauth: ${ctx.isUnauthenticated()},
    User:
    `);
    console.log(ctx.state.user);
    console.log(ctx.req.user);
    if (ctx.state.user) {
        await ctx.render("success.ejs");
    } else {
        await ctx.render("fail.ejs");
    }
});


app.listen(3000);

让我们来看一个示例交互： 您单击索引上的一个按钮将您带到 /auth/steam。 Trying to auth 在（我的）控制台中打印，您将被重定向到 Steam。您登录（登录后您将被重定向到 /text）。

Trying to auth
   
    Auth: false,
    Unauth: true,
    User:
    
undefined //ctx.state.user, this is how koa-passport should expose the authenticated user.
undefined //ctx.req.user, as a test. I don't expect it to be defined but I see it mentioned in some docs.
Returned from Steam: {YOUR PROFILE!}
Serializing: {YOUR PROFILE!}

我的测试打印显示 Auth/Unauth/User 的信息是在配置文件之前打印的，我认为这是因为某种异步竞赛。 可以肯定的是，您将重新加载页面 (/text) 以再次获取此类信息：

    Auth: false,
    Unauth: true,
    User:
    
undefined
undefined

没有变化！

Answer 1

你现在可能已经从这个开始了，但你的问题给了我在我的项目中进行 Steam 身份验证所需的内容，所以我想我会分享我的发现。

我没有直接运行您的代码示例，但我认为这是 2 个问题。

首先，您的 /auth/steam/return 端点需要更新。它应该是这样的：

router.get("/auth/steam/return", async (ctx, next) => {
    return passport.authenticate('steam', { failureRedirect: "/fail", successRedirect: "/text" })(ctx);
});

其次，我在会话配置方面遇到了问题。特别是secure: true 对我不起作用，因为我正在通过不安全的连接（http）进行测试。 localhost 可能有一个例外，但如果没有，更改CONFIG 对我有用。我还更改了 maxAge，因为它设置为 10 秒或 10,000 毫秒。

const CONFIG = {
    key: 'koa.sess',
    maxAge: 86400000,
    secure: false
}