表达限制资源的优雅方法属于特定用户
我发现了很多有关基于权限/角色的授权的线程。但是，我正在寻找一种优雅的方式或任何bast练习来返回数据/资源属于特定用户？
例如：我希望http：// localhost：3000/交易不会返回所有交易，只有属于启动请求的已认证的用户的事务。
我的简单/手动解决方案？每个事务项目都有user_id字段，因此我可以编写解码JWT令牌的中间件，并从令牌中获取user_id，然后将其暴露于请求对象（IE request.user_id = User_id来自令牌）。对于每条路线（如交易），我可以使用此request.user_id并将其添加到查询中。
我想知道，在express/node.js应用程序中处理此问题的最佳解决方案是什么？图书馆？服务？ SaaS？
I found a lot of thread about permissions/role based authorization. however i'm looking for an elegant way or any bast practice to return data/resource belongs to specific user?
for example: I expect that http://localhost:3000/transactions will not return all transactions, only the transactions that belongs to the authenticated user that initiated the request.
my simple/manually solution? each transaction item has user_id field, so I can write middleware that decode the jwt token and takes the user_id from the token and expose it to the request object (i.e request.user_id = user_id from the token). and for each route (like transaction) i can take this request.user_id and add it to the query.
I wonder, what's is the best solution to handle this in express/node.js application? library? service? SaaS?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您的方法听起来正确。用户ID是用于授权的值，以数字可验证的方式接收，并称为a 索赔。一种好的方法是设计
索赔或索赔包含API业务授权使用的详细信息的对象。在node.js中，当令牌经过验证时，有时会在中间件中处理，然后将其保存到
wespons.locals.locals.locals.claims中，如我的代码。然后，如您所描述的那样，商业逻辑可以使用这些值。Your approach sounds correct. UserID is a value used for authorization, received in a digitally verifiable way, and referred to as a claim. A good approach is to design a
claimsorclaimsPrincipalobject containing details like this, used by your API's business authorization.In Node.js this is sometimes processed in middleware when the token is validated and then saved to
response.locals.claims, as in this code of mine. The values can then be used by business logic as you describe.