Feathers.js 认证与授权 - 构建安全的API系统

发布时间：2024-05-29
作者：一介布衣
标签：Feathers.js, 认证, 授权, JWT, 安全

前言

上一篇文章我们深入学习了钩子系统，今天咱们来重点学习 Feathers.js 的认证与授权系统。说实话，安全性是任何 Web 应用都不能忽视的重要环节，而 Feathers.js 在这方面提供了非常完善的解决方案。

我记得刚开始做 Web 开发的时候，总是把认证和授权搞混，以为登录了就万事大吉。后来踩了不少坑才明白，认证只是确认"你是谁"，而授权是确认"你能做什么"。Feathers.js 的认证系统设计得很巧妙，不仅支持多种认证策略，还能很好地与钩子系统结合实现细粒度的权限控制。

今天我就带大家从基础的用户认证开始，一步步构建一个完整的安全系统。

认证系统概述

认证 vs 授权

javascript

// 认证 (Authentication) - 确认用户身份
"你是 John Doe 吗？" → 验证用户名密码、JWT token 等

// 授权 (Authorization) - 确认用户权限  
"John Doe 可以删除这篇文章吗？" → 检查角色、权限、资源所有权等

Feathers.js 认证架构

javascript

// 认证流程
Client Request
    ↓
Authentication Strategy (local, jwt, oauth)
    ↓
User Verification
    ↓
Token Generation/Validation
    ↓
User Object in context.params.user
    ↓
Authorization Hooks
    ↓
Service Method Execution

基础认证配置

1. 安装认证插件

bash

npm install @feathersjs/authentication @feathersjs/authentication-local @feathersjs/authentication-oauth

2. 认证配置

javascript

// config/default.json
{
  "authentication": {
    "secret": "your-super-secret-key",
    "strategies": ["jwt", "local"],
    "path": "/authentication",
    "service": "users",
    "jwt": {
      "header": { "typ": "access" },
      "audience": "https://yourdomain.com",
      "subject": "anonymous",
      "issuer": "feathers",
      "algorithm": "HS256",
      "expiresIn": "1d"
    },
    "local": {
      "usernameField": "email",
      "passwordField": "password"
    }
  }
}

3. 应用配置

javascript

// src/authentication.js
const { AuthenticationService, JWTStrategy } = require('@feathersjs/authentication');
const { LocalStrategy } = require('@feathersjs/authentication-local');
const { expressOauth } = require('@feathersjs/authentication-oauth');

module.exports = app => {
  const authentication = new AuthenticationService(app);

  authentication.register('jwt', new JWTStrategy());
  authentication.register('local', new LocalStrategy());

  app.use('/authentication', authentication);
  app.configure(expressOauth());
};

用户模型和服务

1. 用户模型

javascript

// src/models/users.model.js
module.exports = function (app) {
  const modelName = 'users';
  const mongooseClient = app.get('mongooseClient');
  const { Schema } = mongooseClient;

  const schema = new Schema({
    email: {
      type: String,
      unique: true,
      lowercase: true,
      required: true,
      validate: {
        validator: function(v) {
          return /^\w+([.-]?\w+)*@\w+([.-]?\w+)*(\.\w{2,3})+$/.test(v);
        },
        message: '邮箱格式不正确'
      }
    },
    password: {
      type: String,
      required: true,
      minlength: 6
    },
    
    // 基本信息
    username: {
      type: String,
      unique: true,
      required: true,
      trim: true,
      minlength: 3,
      maxlength: 30
    },
    firstName: {
      type: String,
      trim: true,
      maxlength: 50
    },
    lastName: {
      type: String,
      trim: true,
      maxlength: 50
    },
    avatar: {
      type: String,
      default: null
    },
    
    // 角色和权限
    role: {
      type: String,
      enum: ['user', 'moderator', 'admin'],
      default: 'user'
    },
    permissions: [{
      type: String,
      enum: [
        'read:posts', 'write:posts', 'delete:posts',
        'read:users', 'write:users', 'delete:users',
        'read:comments', 'write:comments', 'delete:comments',
        'manage:system'
      ]
    }],
    
    // 账户状态
    status: {
      type: String,
      enum: ['active', 'inactive', 'suspended', 'pending'],
      default: 'pending'
    },
    emailVerified: {
      type: Boolean,
      default: false
    },
    emailVerificationToken: {
      type: String,
      default: null
    },
    
    // 安全相关
    lastLoginAt: {
      type: Date,
      default: null
    },
    loginAttempts: {
      type: Number,
      default: 0
    },
    lockUntil: {
      type: Date,
      default: null
    },
    passwordResetToken: {
      type: String,
      default: null
    },
    passwordResetExpires: {
      type: Date,
      default: null
    },
    
    // 偏好设置
    preferences: {
      theme: {
        type: String,
        enum: ['light', 'dark', 'auto'],
        default: 'light'
      },
      language: {
        type: String,
        default: 'zh-CN'
      },
      notifications: {
        email: { type: Boolean, default: true },
        push: { type: Boolean, default: true },
        sms: { type: Boolean, default: false }
      }
    }
  }, {
    timestamps: true
  });

  // 索引
  schema.index({ email: 1 });
  schema.index({ username: 1 });
  schema.index({ role: 1 });
  schema.index({ status: 1 });

  // 虚拟字段
  schema.virtual('fullName').get(function() {
    return `\${this.firstName || ''} \${this.lastName || ''}`.trim();
  });

  schema.virtual('isLocked').get(function() {
    return !!(this.lockUntil && this.lockUntil > Date.now());
  });

  // 实例方法
  schema.methods.toSafeObject = function() {
    const obj = this.toObject();
    delete obj.password;
    delete obj.emailVerificationToken;
    delete obj.passwordResetToken;
    delete obj.loginAttempts;
    delete obj.lockUntil;
    return obj;
  };

  schema.methods.hasPermission = function(permission) {
    // 管理员拥有所有权限
    if (this.role === 'admin') {
      return true;
    }
    
    // 检查具体权限
    return this.permissions.includes(permission);
  };

  schema.methods.hasRole = function(roles) {
    const roleArray = Array.isArray(roles) ? roles : [roles];
    return roleArray.includes(this.role);
  };

  schema.methods.canAccess = function(resource, action = 'read') {
    const permission = `\${action}:\${resource}`;
    return this.hasPermission(permission);
  };

  return mongooseClient.model(modelName, schema);
};

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171

2. 用户服务钩子

javascript

// src/services/users/users.hooks.js
const { authenticate } = require('@feathersjs/authentication').hooks;
const { hashPassword, protect } = require('@feathersjs/authentication-local').hooks;
const { disallow, iff, isProvider } = require('feathers-hooks-common');

// 验证用户数据
const validateUser = () => {
  return async context => {
    const { data } = context;
    
    // 检查用户名唯一性
    if (data.username) {
      const existingUser = await context.app.service('users').find({
        query: { 
          username: data.username,
          $limit: 1
        }
      });
      
      if (existingUser.total > 0 && existingUser.data[0]._id.toString() !== context.id) {
        throw new Error('用户名已存在');
      }
    }
    
    // 检查邮箱唯一性
    if (data.email) {
      const existingUser = await context.app.service('users').find({
        query: { 
          email: data.email,
          $limit: 1
        }
      });
      
      if (existingUser.total > 0 && existingUser.data[0]._id.toString() !== context.id) {
        throw new Error('邮箱已被注册');
      }
    }
    
    return context;
  };
};

// 权限检查
const checkPermissions = () => {
  return async context => {
    const { user } = context.params;
    
    if (!user) {
      throw new Error('用户未登录');
    }
    
    // 用户只能查看自己的信息，除非是管理员
    if (context.method === 'get' && context.id) {
      if (context.id !== user._id.toString() && user.role !== 'admin') {
        throw new Error('无权限访问其他用户信息');
      }
    }
    
    // 用户只能修改自己的信息，除非是管理员
    if (['update', 'patch'].includes(context.method)) {
      if (context.id !== user._id.toString() && user.role !== 'admin') {
        throw new Error('无权限修改其他用户信息');
      }
      
      // 普通用户不能修改角色和权限
      if (user.role !== 'admin' && (context.data.role || context.data.permissions)) {
        delete context.data.role;
        delete context.data.permissions;
      }
    }
    
    // 只有管理员可以删除用户
    if (context.method === 'remove' && user.role !== 'admin') {
      throw new Error('无权限删除用户');
    }
    
    return context;
  };
};

// 限制查询结果
const restrictFind = () => {
  return async context => {
    const { user } = context.params;
    
    if (!user) {
      throw new Error('用户未登录');
    }
    
    // 普通用户只能查看激活的用户基本信息
    if (user.role !== 'admin') {
      context.params.query.status = 'active';
      context.params.query.$select = ['_id', 'username', 'firstName', 'lastName', 'avatar'];
    }
    
    return context;
  };
};

// 设置默认值
const setDefaults = () => {
  return context => {
    if (context.data) {
      // 新用户默认状态
      if (context.method === 'create') {
        context.data.status = 'pending';
        context.data.emailVerified = false;
        context.data.role = context.data.role || 'user';
      }
    }
    return context;
  };
};

module.exports = {
  before: {
    all: [],
    find: [
      iff(isProvider('external'), authenticate('jwt')),
      iff(isProvider('external'), restrictFind())
    ],
    get: [
      iff(isProvider('external'), authenticate('jwt')),
      iff(isProvider('external'), checkPermissions())
    ],
    create: [
      hashPassword('password'),
      validateUser(),
      setDefaults()
    ],
    update: [
      iff(isProvider('external'), authenticate('jwt')),
      iff(isProvider('external'), checkPermissions()),
      hashPassword('password'),
      validateUser()
    ],
    patch: [
      iff(isProvider('external'), authenticate('jwt')),
      iff(isProvider('external'), checkPermissions()),
      hashPassword('password'),
      validateUser()
    ],
    remove: [
      iff(isProvider('external'), authenticate('jwt')),
      iff(isProvider('external'), checkPermissions())
    ]
  },

  after: {
    all: [
      // 确保密码字段不会被返回
      protect('password')
    ],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  },

  error: {
    all: [],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  }
};

高级认证策略

1. 自定义认证策略

javascript

// src/authentication/custom-strategy.js
const { AuthenticationBaseStrategy } = require('@feathersjs/authentication');

class ApiKeyStrategy extends AuthenticationBaseStrategy {
  async authenticate(authentication, params) {
    const { apiKey } = authentication;
    
    if (!apiKey) {
      throw new Error('API Key 不能为空');
    }
    
    // 验证 API Key
    const user = await this.app.service('users').find({
      query: {
        apiKey: apiKey,
        status: 'active'
      }
    });
    
    if (user.total === 0) {
      throw new Error('无效的 API Key');
    }
    
    return {
      authentication: { strategy: this.name },
      user: user.data[0]
    };
  }
}

module.exports = ApiKeyStrategy;

2. OAuth 认证

javascript

// src/authentication/oauth.js
const { OAuthStrategy } = require('@feathersjs/authentication-oauth');

class GitHubStrategy extends OAuthStrategy {
  async getEntityData(profile, existing, params) {
    const baseData = await super.getEntityData(profile, existing, params);
    
    return {
      ...baseData,
      githubId: profile.id,
      username: profile.login,
      email: profile.email,
      avatar: profile.avatar_url,
      firstName: profile.name ? profile.name.split(' ')[0] : '',
      lastName: profile.name ? profile.name.split(' ').slice(1).join(' ') : '',
      emailVerified: true,
      status: 'active'
    };
  }
  
  async getProfile(authResult, params) {
    const profile = await super.getProfile(authResult, params);
    
    // 获取用户的邮箱（如果公开的话）
    if (!profile.email) {
      try {
        const response = await this.request({
          url: 'https://api.github.com/user/emails',
          headers: {
            authorization: `token \${authResult.access_token}`
          }
        });
        
        const emails = response.data;
        const primaryEmail = emails.find(email => email.primary);
        if (primaryEmail) {
          profile.email = primaryEmail.email;
        }
      } catch (error) {
        console.error('获取 GitHub 邮箱失败:', error);
      }
    }
    
    return profile;
  }
}

// 配置 OAuth
module.exports = app => {
  const authentication = app.service('authentication');
  
  authentication.register('github', new GitHubStrategy());
  
  // 配置 OAuth 路由
  app.get('/oauth/github', authentication.authenticate('github'));
  app.get('/oauth/github/callback', 
    authentication.authenticate('github'),
    (req, res) => {
      res.redirect('/dashboard');
    }
  );
};

3. 多因素认证

javascript

// src/services/mfa/mfa.class.js
const speakeasy = require('speakeasy');
const QRCode = require('qrcode');

class MFAService {
  constructor(options, app) {
    this.options = options || {};
    this.app = app;
  }

  // 生成 TOTP 密钥
  async create(data, params) {
    const { user } = params;
    
    if (!user) {
      throw new Error('用户未登录');
    }
    
    const secret = speakeasy.generateSecret({
      name: `\${this.app.get('appName')}:\${user.email}`,
      issuer: this.app.get('appName')
    });
    
    // 保存密钥到用户记录
    await this.app.service('users').patch(user._id, {
      mfaSecret: secret.base32,
      mfaEnabled: false
    });
    
    // 生成二维码
    const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
    
    return {
      secret: secret.base32,
      qrCode: qrCodeUrl,
      manualEntryKey: secret.base32
    };
  }

  // 验证 TOTP 代码
  async update(id, data, params) {
    const { user } = params;
    const { token } = data;
    
    if (!user || !user.mfaSecret) {
      throw new Error('MFA 未设置');
    }
    
    const verified = speakeasy.totp.verify({
      secret: user.mfaSecret,
      encoding: 'base32',
      token: token,
      window: 2  // 允许前后2个时间窗口
    });
    
    if (!verified) {
      throw new Error('验证码错误');
    }
    
    // 启用 MFA
    await this.app.service('users').patch(user._id, {
      mfaEnabled: true
    });
    
    return { message: 'MFA 启用成功' };
  }

  // 验证登录时的 MFA
  async patch(id, data, params) {
    const { userId, token } = data;
    
    const user = await this.app.service('users').get(userId);
    
    if (!user.mfaEnabled || !user.mfaSecret) {
      throw new Error('用户未启用 MFA');
    }
    
    const verified = speakeasy.totp.verify({
      secret: user.mfaSecret,
      encoding: 'base32',
      token: token,
      window: 2
    });
    
    if (!verified) {
      throw new Error('验证码错误');
    }
    
    return { verified: true };
  }

  // 禁用 MFA
  async remove(id, params) {
    const { user } = params;
    
    if (!user) {
      throw new Error('用户未登录');
    }
    
    await this.app.service('users').patch(user._id, {
      mfaSecret: null,
      mfaEnabled: false
    });
    
    return { message: 'MFA 已禁用' };
  }
}

module.exports = MFAService;

权限控制系统

1. 基于角色的访问控制（RBAC）

javascript

// src/hooks/rbac.js
const roles = {
  admin: {
    permissions: ['*'],  // 所有权限
    inherits: []
  },
  moderator: {
    permissions: [
      'read:posts', 'write:posts', 'delete:posts',
      'read:comments', 'write:comments', 'delete:comments',
      'read:users'
    ],
    inherits: ['user']
  },
  user: {
    permissions: [
      'read:posts', 'write:own:posts',
      'read:comments', 'write:comments',
      'read:profile', 'write:own:profile'
    ],
    inherits: []
  }
};

const getUserPermissions = (userRole) => {
  const role = roles[userRole];
  if (!role) return [];
  
  let permissions = [...role.permissions];
  
  // 继承父角色权限
  role.inherits.forEach(inheritedRole => {
    permissions = permissions.concat(getUserPermissions(inheritedRole));
  });
  
  return [...new Set(permissions)];  // 去重
};

const hasPermission = (user, permission, resource = null) => {
  const userPermissions = getUserPermissions(user.role);
  
  // 检查通配符权限
  if (userPermissions.includes('*')) {
    return true;
  }
  
  // 检查精确权限
  if (userPermissions.includes(permission)) {
    return true;
  }
  
  // 检查资源所有权权限
  if (resource && userPermissions.includes(permission.replace(':', ':own:'))) {
    return resource.userId && resource.userId.toString() === user._id.toString();
  }
  
  return false;
};

// 权限检查钩子
const requirePermission = (permission) => {
  return async (context) => {
    const { user } = context.params;
    
    if (!user) {
      throw new Error('用户未登录');
    }
    
    let resource = null;
    
    // 对于需要资源的操作，获取资源信息
    if (context.id && ['get', 'update', 'patch', 'remove'].includes(context.method)) {
      try {
        resource = await context.service.get(context.id, {
          ...context.params,
          query: {}
        });
      } catch (error) {
        // 资源不存在
        throw new Error('资源不存在');
      }
    }
    
    if (!hasPermission(user, permission, resource)) {
      throw new Error(`需要权限: \${permission}`);
    }
    
    return context;
  };
};

module.exports = {
  getUserPermissions,
  hasPermission,
  requirePermission
};

2. 资源级权限控制

javascript

// src/hooks/resource-permissions.js
const { requirePermission } = require('./rbac');

// 动态权限检查
const checkResourcePermission = (resourceType) => {
  return async (context) => {
    const { method, user } = context.params;
    
    const actionMap = {
      find: 'read',
      get: 'read',
      create: 'write',
      update: 'write',
      patch: 'write',
      remove: 'delete'
    };
    
    const action = actionMap[context.method];
    const permission = `\${action}:\${resourceType}`;
    
    return requirePermission(permission)(context);
  };
};

// 字段级权限控制
const filterFields = (allowedFields) => {
  return (context) => {
    const { user } = context.params;
    
    if (user.role === 'admin') {
      return context;  // 管理员可以看到所有字段
    }
    
    const filterData = (data) => {
      const filtered = {};
      allowedFields.forEach(field => {
        if (data[field] !== undefined) {
          filtered[field] = data[field];
        }
      });
      return filtered;
    };
    
    if (context.result) {
      if (Array.isArray(context.result.data)) {
        context.result.data = context.result.data.map(filterData);
      } else {
        context.result = filterData(context.result);
      }
    }
    
    return context;
  };
};

// 使用示例
app.service('posts').hooks({
  before: {
    all: [authenticate('jwt')],
    find: [checkResourcePermission('posts')],
    get: [checkResourcePermission('posts')],
    create: [checkResourcePermission('posts')],
    update: [checkResourcePermission('posts')],
    patch: [checkResourcePermission('posts')],
    remove: [checkResourcePermission('posts')]
  },
  after: {
    all: [
      filterFields(['id', 'title', 'content', 'author', 'createdAt', 'updatedAt'])
    ]
  }
});

安全增强

1. 账户锁定机制

javascript

// src/hooks/account-security.js
const MAX_LOGIN_ATTEMPTS = 5;
const LOCK_TIME = 2 * 60 * 60 * 1000; // 2小时

const handleLoginAttempt = () => {
  return async (context) => {
    const { email } = context.data;
    
    const user = await context.app.service('users').find({
      query: { email, $limit: 1 }
    });
    
    if (user.total === 0) {
      throw new Error('用户不存在');
    }
    
    const userData = user.data[0];
    
    // 检查账户是否被锁定
    if (userData.isLocked) {
      throw new Error(`账户已被锁定，请在 \${new Date(userData.lockUntil).toLocaleString()} 后重试`);
    }
    
    // 将用户信息存储到 context 中，供后续使用
    context.userData = userData;
    
    return context;
  };
};

const handleLoginFailure = () => {
  return async (context) => {
    const { userData } = context;
    
    if (!userData) return context;
    
    const updates = {
      loginAttempts: userData.loginAttempts + 1
    };
    
    // 如果达到最大尝试次数，锁定账户
    if (updates.loginAttempts >= MAX_LOGIN_ATTEMPTS) {
      updates.lockUntil = new Date(Date.now() + LOCK_TIME);
    }
    
    await context.app.service('users').patch(userData._id, updates);
    
    throw new Error(`登录失败，剩余尝试次数: \${MAX_LOGIN_ATTEMPTS - updates.loginAttempts}`);
  };
};

const handleLoginSuccess = () => {
  return async (context) => {
    const { user } = context.result;
    
    // 清除登录尝试记录
    await context.app.service('users').patch(user._id, {
      loginAttempts: 0,
      lockUntil: null,
      lastLoginAt: new Date()
    });
    
    return context;
  };
};

module.exports = {
  handleLoginAttempt,
  handleLoginFailure,
  handleLoginSuccess
};

2. 密码安全策略

javascript

// src/hooks/password-security.js
const bcrypt = require('bcryptjs');

const validatePasswordStrength = () => {
  return (context) => {
    const { password } = context.data;
    
    if (!password) return context;
    
    const minLength = 8;
    const hasUpperCase = /[A-Z]/.test(password);
    const hasLowerCase = /[a-z]/.test(password);
    const hasNumbers = /\d/.test(password);
    const hasSpecialChar = /[!@#$%^&*(),.?":{}|&lt;&gt;]/.test(password);
    
    const errors = [];
    
    if (password.length &lt; minLength) {
      errors.push(`密码长度至少 \${minLength} 位`);
    }
    
    if (!hasUpperCase) {
      errors.push('密码必须包含大写字母');
    }
    
    if (!hasLowerCase) {
      errors.push('密码必须包含小写字母');
    }
    
    if (!hasNumbers) {
      errors.push('密码必须包含数字');
    }
    
    if (!hasSpecialChar) {
      errors.push('密码必须包含特殊字符');
    }
    
    if (errors.length &gt; 0) {
      throw new Error(`密码强度不足: \${errors.join(', ')}`);
    }
    
    return context;
  };
};

const preventPasswordReuse = (historyCount = 5) => {
  return async (context) => {
    const { password } = context.data;
    const { user } = context.params;
    
    if (!password || !user) return context;
    
    // 获取用户的密码历史
    const passwordHistory = user.passwordHistory || [];
    
    // 检查是否重复使用了最近的密码
    for (const oldPassword of passwordHistory.slice(-historyCount)) {
      if (await bcrypt.compare(password, oldPassword)) {
        throw new Error(`不能重复使用最近 \${historyCount} 次的密码`);
      }
    }
    
    // 更新密码历史
    const newHistory = [...passwordHistory, user.password].slice(-historyCount);
    context.data.passwordHistory = newHistory;
    
    return context;
  };
};

module.exports = {
  validatePasswordStrength,
  preventPasswordReuse
};

总结

通过这篇文章，我们深入学习了 Feathers.js 的认证与授权系统：

✅ 认证系统基础：

认证 vs 授权的区别
JWT 和本地认证策略
用户模型设计

✅ 高级认证策略：

自定义认证策略
OAuth 第三方登录
多因素认证（MFA）

✅ 权限控制系统：

基于角色的访问控制（RBAC）
资源级权限控制
字段级权限过滤

✅ 安全增强措施：

账户锁定机制
密码安全策略
登录失败处理

掌握了这些知识，你就能够构建一个安全可靠的 API 系统，包括：

多层次的身份验证
细粒度的权限控制
完善的安全防护机制
用户友好的安全体验

下一篇文章，我们将学习 Feathers.js 的实时功能，看看如何构建强大的 WebSocket 应用。

相关文章推荐：

有问题欢迎留言讨论，我会及时回复大家！

🧭 快速导航

Feathers.js 认证与授权 - 构建安全的API系统 ​

前言 ​

认证系统概述 ​

认证 vs 授权 ​

Feathers.js 认证架构 ​

基础认证配置 ​

1. 安装认证插件 ​

2. 认证配置 ​

3. 应用配置 ​

用户模型和服务 ​

1. 用户模型 ​

2. 用户服务钩子 ​

高级认证策略 ​

1. 自定义认证策略 ​

2. OAuth 认证 ​

3. 多因素认证 ​

权限控制系统 ​

1. 基于角色的访问控制（RBAC） ​

2. 资源级权限控制 ​

安全增强 ​

1. 账户锁定机制 ​

2. 密码安全策略 ​

总结 ​

Feathers.js 认证与授权 - 构建安全的API系统

前言

认证系统概述

认证 vs 授权

Feathers.js 认证架构

基础认证配置

1. 安装认证插件

2. 认证配置

3. 应用配置

用户模型和服务

1. 用户模型

2. 用户服务钩子

高级认证策略

1. 自定义认证策略

2. OAuth 认证

3. 多因素认证

权限控制系统

1. 基于角色的访问控制（RBAC）

2. 资源级权限控制

安全增强

1. 账户锁定机制

2. 密码安全策略

总结