我在这里做错了什么 node+express + vue SPA getCSRFTOKEN()

问题描述

我的 index.js 服务器

// USE STRICT;
const express = require('express');
const app = express();
const session = require('express-session');
const http = require('http').Server(app);
const socket = require('socket.io');
const schedule = require('node-schedule');

const cors = require('cors');
const io = socket(http,{
    cors: {
        origin: 'http://localhost:8080',methods: ['GET','POST'],allowedHeaders: ['my-custom-header'],credentials: true
    }
});

const port = 8080;

app.use(express.static(__dirname + '/public'));
app.use(express.static(__dirname + '/uploads'));

const cookieParser = require('cookie-parser');
const csrf = require('csurf');
const mustacheExpress = require('mustache-express');
app.engine('html',mustacheExpress());
app.set('view engine','html');
app.set('views',__dirname + '/views');
const secret = 'somesecretkeyhere';
const passport = require('passport');
const helmet = require('helmet');
const { sendMail } = require('./controllers/sellerAdsController');
// Gives us access to variables set in the .env file via `process.env.VARIABLE_NAME` Syntax
// require('dotenv').config();
// Must first load the models before passport
require('./models/user');
// Pass the global passport object into the configuration function
require('./config/passport')(passport);

// This will initialize the passport object on every request
app.use(passport.initialize());

// Allows our remote applications to make HTTP requests to Express application
app.use(cors());

app.use(helmet());

app.use(express.urlencoded({ extended: false }));
// app.use(express.json()); //WARNING: Do not turn on. stops formidable for api calls

app.use(cookieParser(secret));
app.use(session({
    secret: secret,resave: false,saveUninitialized: true,cookie: {
        httpOnly: true,secure: true
    }
}));
app.use(csrf());
// Stop page caching
app.use(function (req,res,next) {
    res.set('Cache-Control','no-cache,private,no-store,must-revalidate,max-stale=0,post-check=0,pre-check=0');
    next();
});

// Imports all of the routes from ./routes/index.js
app.use(require('./routes/api/v1'));



// Socket Operations
// io.on('connection',io => {
//  let sessionId = io.id;

//  io.on('clientHandshake',(data) => {
//      console.log(data);

//      io.emit('serverHandshake',{ sessionId: sessionId });
//  });
// });
// io.use((socket,next) => {
//  const username = socket.handshake.auth.username;
//  if (!username) {
//      return next(new Error('invalid username'));
//  }
//  console.log(username);
//  socket.username = username;
//  next();
// });

io.on('connection',(socket) => {
    console.log('? New socket connected! >>',socket.id);
    // notify existing users
    socket.broadcast.emit('user connected',{
        userID: socket.id,username: socket.username,});

    socket.on('private message',({ content,to }) => {
        socket.to(to).emit('private message',{
            content,from: socket.id,});
        console.log(content,to);
    });
});


// EROOR HANDLING ROUTES MUST BE BENEATH ALL APP.USE AND ROUTES
// Check if request is from web or app (HTML/JSON)
// Handle 404
app.use(function (req,res) {
    res.status(404);
    res.render('404.html',{ title: '404: File Not Found' });
});

// Handle 500
app.use(function (error,req,res) {
    return res.send(error);
    // res.status(500);
    // res.render('500.html',{ title: '500: Internal Server Error',error: error });
});

// SCHEDULED JOBS
const Now = new Date();
let date = new Date(Now.getFullYear(),Now.getMonth(),Now.getDate(),23,59,0);
schedule.scheduleJob(date,sendMail);

http.listen(port,() => {
    console.log(`listening on *:${port}`);
});

这就是我从 VUE 获得的方式

window.axios.get('/databank/getCSRF').then((response) => {
    
    
    window.axios.defaults.headers.common['XSRF-TOKEN'] = response.data;
},(err) => {
    console.log(err)
})

这是我的登录请求标头 XSRF-TOKEN from my login request header sent by axios

所以我已经像这样设置了我的服务器和我的 vue SPA,但是 getCSRF() 似乎收到了请求,但我无法将 POST 请求发回服务器引发错误

禁止错误:无效的 csrf 令牌 在 csrf

解决方法

暂无找到可以解决该程序问题的有效方法,小编努力寻找整理中!

如果你已经找到好的解决方法,欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@)