使用Strongloop loopback进行电子邮件验证 - 返回验证令牌

3 回答

• 4

  我刚刚完成了这个例子 . 看到：

  https://github.com/strongloop/loopback-faq-user-management

  回复于 2024-04-25T15:36:13+08:00
• 1

  如果你想创建用户注册验证链接但不使用内置用户现代，那么你需要创建验证令牌然后发送link.i已经添加了两个方法 . 你需要使用远程方法与一个参数谁是对象type：你需要用寄存器email发送参数 . 方法是这样的....这里我们使用user = any变量名，modelN =模型名

  modelN.sendVerificationEmail = function (data, callback) {
    var user = loopback.models.modelN;
  
    if (!data.email) {
      return callback(commonUtils.buildError(
        'Recipient email is required.', 400, 'EMAIL_REQUIRED'
      ));
    }
  
    if (!emailValidator.validate(data.email)) {
      return callback(commonUtils.buildError(
        'Must provide a valid email.', 400, 'INVALID_EMAIL'
      ));
    }
  
    var findOneuserPromise
      = modelN.findOne({ 'where': { 'email': data.email }});
  
    findOneBusinessEmployeePromise.then(function (user) {
      if (!user) {
        return callback();
      }
  
      var sendVerificationEmailPromise
        = anothermodelname.sendVerificationEmail(user.id);
  
      sendVerificationEmailPromise.then(function () {
        callback();
      });
  
      sendVerificationEmailPromise.then(null, function (error) {
        callback(error);
      });
    });
  
    findOneuserPromise.then(null, function (error) {
      callback(error);
    });
  };
  

  我添加了另一个模型模型方法然后添加这个，....

  anothermodelname.sendVerificationEmail = function (userid) {
    var modelN = loopback.models.modelN;
    var Email = loopback.models.Email;
    var deferred = Q.defer();
    var findByIduserPromise = modelN.findById(userId);
  
    findByIduserPromise.then(function (user) {
      if (!user) {
        return deferred.reject(commonUtils.buildError(
          'Unknown "modelN" id "' + userId + '".',
          404, 'MODEL_NOT_FOUND'
        ));
      }
      if (!user.verificationToken) {
        return deferred.resolve(true);
      }
  
  
      modelN.generateVerificationToken(user,
        function (verificationTokenError, verificationToken) {
          if (verificationTokenError) {
            return deferred.reject(verificationTokenError);
          }
  
          user.verificationToken = verificationToken;
  
          var saveuserPromise = user.save();
  
          saveuserPromise.then(function (updateduser) {
            var link = emailConf.clientBaseUrl +
              emailConf.verifyEmailRedirect + '?uid=' +
              updateduser.id + '&token=' +
              updateduser.verificationToken;
                 console.log("check+link:",link);
            /*eslint camelcase: [0, {properties: "never"}]*/
            emailOptions.to = updateduser.email;
            emailOptions.template = { 'name': 'verify' };
            emailOptions.global_merge_vars = [];
  
            emailOptions.global_merge_vars.push({
              'name': 'USER_NAME',
              'content': updateduser.name
              || updateduser.username || updateduser.email
            });
  
            emailOptions.global_merge_vars.push({
              'name': 'LINK',
              'content': link
            });
            Email.send(emailOptions, function () {});
  
            deferred.resolve(true);
          });
  
          saveuserPromise.then(null, function (error) {
            deferred.reject(error);
          });
        });
    });
  
    findByIduserPromise.then(null, function (error) {
      deferred.reject(error);
    });
  
    return deferred.promise;
  };
  

  回复于 2024-04-25T15:36:13+08:00
• 2

  @ user2483431，验证电子邮件会将响应中的电子邮件验证令牌与用户ID一起公开 . 正如您所指出的那样，它可能会欺骗系统 . 一种解决方案是从响应中剥离令牌值 .

  在afterRemote for user create中，你可以使用，

  user.verify(options, function(err, response, next2) {
    if (err) {
      // error handling code
    }
    // stripping off verificationToken from response for security
    var replacementText = "check email"
    context.result.verificationToken = replacementText;
    next();
  });
  

  希望这可以帮助！

  回复于 2024-04-25T15:36:13+08:00