June 2021
Intermediate to advanced
290 pages
9h 21m
Chinese
Content preview from Node与Express开发（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
安全
｜
201
app.enable('trust proxy')
。如此调用之后，
req.protocol
、
req.secure
和
req.ip
呈现的
将是客户端到代理而不是到应用的连接。
18.2
跨站请求伪造
跨站请求伪造
（
CSRF
）攻击利用了这样一个事实
：用户通常会信任他们的浏览器，并且
会在一个浏览器会话里访问多个网站。在
CSRF
攻
击中，来自恶意网站的脚本会向目标网
站发出请求，而如果你已经登录了目标网站，恶意网站就可以成功地访问到目标网站的敏
感数据。
为了防止网站遭受
CSRF
攻击
，必须要有一种办法来确认请求的确是从你的网站发出的。
我们确认的办法就是给浏览器传一个唯一的令牌，当随后浏览器提交表单时，服务器会检
查并确认令牌是否匹配。中间件
csurf
可以创建令牌和验证，你需要做的就是确保令牌包
含在发到服务器的请求中。先安装
csurf
中间件（
npm install csurf
），然后把它链进来，
并在
res.locals
中加入一个令牌。请确保是在
body-parser
、
cookie-parser
和
express-
session
之后链入
csurf
中间件：
// 必须在body-parser、cookie-parser和express-session之后链入
const csrf = require('csurf')
app.use(csrf({ cookie: true }))
app.use((req, res, next) => {
res.locals._csrfToken = req.csrfToken() ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.