javascript - Node.js，即使条件为假，也表示语句是否运行

Question

我正在尝试检查登录用户是否为管理员。用户数据以如下格式存储：

[
  {
    "isAdmin": "true",
    "_id": "60c6df22f25d381e78ab5f31",
    "name": "Admin",
    "email": "[e-mail]",
    "password": "$2a$10$dPF0rtehOYXv5aLkmxXgw.99horXCuzbQgvu5ywRaa5C73xQJpaG6",
    "__v": 0,
    "createdAt": "2021-06-14T04:46:26.769Z",
    "updatedAt": "2021-06-14T04:46:26.769Z"
  },
  {
    "isAdmin": "false",
    "_id": "60c6df22f25d381e78ab5f32",
    "name": "Messi",
    "email": "[e-mail]",
    "password": "$2a$10$Lkhuz2///oLfrCRMSYoHoeS3QHUCNQDH3OyiN6LyveogGfzldSBDC",
    "__v": 0,
    "createdAt": "2021-06-14T04:46:26.770Z",
    "updatedAt": "2021-06-20T03:45:44.533Z"
  },
]

当用户输入其凭据时，我正在传递 adminMiddleware 以检查是否isAdmin为真。但是当我在迅雷客户端测试它时，无论我通过谁的不记名令牌（管理员或普通用户），我都会得到用户数据。

这是源代码：

adminMiddleware.js

const admin = (req, res, next) => {
  try {
    console.log("Name:", req.user.name);
    console.log("isAdmin:", req.user.isAdmin);
    if (req.user && req.user.isAdmin) {
      next();
    } else {
      const error = new Error("Not Authorized As An Admin");
      error.status = 401;
      next(error);
    }
  } catch (error) {
    next(error);
  }
};

module.exports = admin;

用户路由.js

const express = require("express");
const {
  registerUser,
  getUsers,
} = require("../controllers/userController");
const protect = require("../middleware/authMiddleware");
const admin = require("../middleware/adminMiddleware");
const router = express.Router();

router.route("/").post(registerUser).get(protect, admin, getUsers);
module.exports = router;

我在控制台中分别通过 Bearer Token 记录了管理员和普通用户的isAdmin值，并得到：

当isAdmin=false

当isAdmin=true

标签： javascriptnode.jsexpressif-statement

Answer 1

req.user.isAdmin解析为字符串，因此，"false"是一个真实值："false" ? true : false.

您应该将支票更改为req.user && req.user.isAdmin === 'true'