signUpWithName.js (JavaScript in the browser)
Bạn đang xem bản rút gọn của tài liệu. Xem và tải ngay bản đầy đủ của tài liệu tại đây (9.79 MB, 388 trang )
var email = document.getElementById('email');
var name = document.getElementById('name');
var password = document.getElementById('password');
var verifyPassword = document.getElementById('verify-password');
result.innerHTML = 'Sign Up...';
if (email.value == null || email.value == '') {
result.innerHTML = 'Please specify your email address.';
} else if (name.value == null || name.value == '') {
result.innerHTML = 'Please specify your name.';
} else if (password.value == null || password.value == '') {
result.innerHTML = 'Please specify a password.';
} else if (password.value != verifyPassword.value) {
result.innerHTML = 'Passwords are different, please check.';
} else {
var input = {
email: email.value,
name: name.value,
password: password.value,
};
lambda.invoke({
FunctionName: 'sampleAuthCreateUser',
Payload: JSON.stringify(input)
}, function(err, data) {
if (err) console.log(err, err.stack);
else {
var output = JSON.parse(data.Payload);
if (output.created) {
result.innerHTML = 'User ' + input.email + ' created. Please check your email to
validate the user and enable login.';
} else {
result.innerHTML = 'User not created.';
}
}
});
}
}
var form = document.getElementById('signup-form');
form.addEventListener('submit', function(evt) {
evt.preventDefault();
signup();
});
createUser Lambda Function (Node.js)
console.log('Loading function');
var AWS = require('aws-sdk');
var crypto = require('crypto');
var cryptoUtils = require('./lib/cryptoUtils');
var config = require('./config');
var dynamodb = new AWS.DynamoDB();
var ses = new AWS.SES();
function storeUser(email, name, password, salt, fn) {
var len = 128;
crypto.randomBytes(len, function(err, token) {
if (err) return fn(err);
token = token.toString('hex');
dynamodb.putItem({
TableName: config.DDB_TABLE,
Item: {
email: {
S: email
},
name: {
S: name
},
passwordHash: {
S: password
},
passwordSalt: {
S: salt
},
verified: {
BOOL: false
},
verifyToken: {
S: token
}
},
ConditionExpression: 'attribute_not_exists (email)'
}, function(err, data) {
if (err) return fn(err);
else fn(null, token);
});
});
}
function sendVerificationEmail(email, name, token, fn) {
var subject = 'Verification Email for ' + config.EXTERNAL_NAME;
https://avxhm.se/blogs/hill0
var verificationLink = config.VERIFICATION_PAGE + '?email=' + encodeURIComponent(email) +
'&verify=' + token;
ses.sendEmail({
Source: config.EMAIL_SOURCE,
Destination: {
ToAddresses: [
email
]
},
Message: {
Subject: {
Data: subject
},
Body: {
Html: {
Data: '
+ ''
+ '
+ ''
+ 'Hello ' + name + ', please click here to
verify your email address or copy & paste the following link in a browser:'
+ '
'
+ '' + verificationLink + ''
+ ''
}
}
}
}, fn);
}
exports.handler = (event, context, callback) => {
var email = event.email;
var name = event.name;
var clearPassword = event.password;
cryptoUtils.computeHash(clearPassword, function(err, salt, hash) {
if (err) {
callback('Error in hash: ' + err);
} else {
storeUser(email, name, hash, salt, function(err, token) {
if (err) {
if (err.code == 'ConditionalCheckFailedException') {
// userId already found
callback(null, { created: false });
} else {
callback('Error in storeUser: ' + err);
}
} else {
sendVerificationEmail(email, name, token, function(err, data) {
if (err) {
callback('Error in sendVerificationEmail: ' + err);
} else {
callback(null, { created: true });
}
});
}
});
}
});
}
Chapter 10. Adding more features to the authentication
service
This chapter covers
•
•
•
•
Managing more use cases, such as resetting and changing passwords
Integrating the login process with Amazon Cognito
Using the login to get AWS credentials as an authenticated user
Allowing access to Lambda functions to only authenticated users
In the previous chapter, you started implementing the serverless architecture for a sample
authentication service (figure 10.1) capable of creating new users and validating the email
address. In this chapter, you’re going to add more interesting features, such as the ability to
change or reset the password, and log in as an Amazon Cognito developer authenticated
identity.
Figure 10.1. The overall serverless architecture of the sample authentication service you’re implementing in this chapter. HTML and
JavaScript files are hosted on Amazon S3. Lambda functions provide the back end logic. A DynamoDB table is used to store user
profiles. Amazon SES sends emails for verification and for password resets.
Note
This example uses both client-side (running in the browser) and server-side (running in Lambda
functions) code. Because the code running in the browser is JavaScript, the Lambda function
examples are also provided in JavaScript. The implementation of those functions in Python is
left as an exercise for you to do on your own, because it doesn’t change the architecture or the
logic of the application.
10.1. REPORTING LOST PASSWORDS
With a flow similar to that of the create and validate user pages, you can implement a reset
password process using an email with a random token to validate the user.
Note
For the sake of simplicity, we’ll call this functionality “lost password,” even though it can cover
different use cases. For example, if the user suspects their credentials have been compromised,
asking for a password reset is a good option.
First, the user reports the lost password in the lostPassword.html page (figure 10.2).
