Google OAuth应用中的会话管理：理解同步注销的局限性与实现独立注销

import express from 'express';
import { google } from 'googleapis';
import jwt from 'jsonwebtoken';
import { PrismaClient } from '@prisma/client';
import dotenv from 'dotenv';

dotenv.config(); // 加载环境变量

const app = express();
const prisma = new PrismaClient();
const secret = process.env.JWT_SECRET || 'your_jwt_secret'; // 确保在生产环境中使用强密钥
const origin = process.env.CLIENT_ORIGIN || 'http://localhost:3000'; // 客户端重定向地址

// 配置Google OAuth客户端
const authClient = new google.auth.OAuth2(
  process.env.GOOGLE_CLIENT_ID,
  process.env.GOOGLE_CLIENT_SECRET,
  process.env.GOOGLE_REDIRECT_URI // 确保与Google Console中配置的一致
);

// 登录回调端点
app.get('/auth/google/callback', async (req, res) => {
  const code = req.query.code as string;
  if (!code) {
    return res.status(400).send('Authorization code missing.');
  }

  try {
    // 使用授权码交换令牌
    const { tokens } = await authClient.getToken(code);
    authClient.setCredentials(tokens);

    // 获取用户信息
    const { data } = await google.oauth2('v2').userinfo.get({ auth: authClient });

    if (!data.id || !data.name) {
      return res.status(500).send('Failed to retrieve user information from Google.');
    }

    // 在数据库中查找或创建用户
    let user = await prisma.user.findUnique({ where: { googleId: data.id! } });
    if (!user) {
      user = await prisma.user.create({
        data: { googleId: data.id!, displayName: data.name! },
      });
    }

    // 签发应用内JWT令牌
    const token = jwt.sign({ id: user.id, googleId: user.googleId, displayName: user.displayName }, secret, {
      expiresIn: '1d', // JWT有效期设置为1天
    });

    // 将JWT作为HTTP Only Cookie发送给客户端
    res.cookie('token', token, {
      httpOnly: true, // 阻止客户端JavaScript访问此Cookie，增强安全性
      maxAge: 24 * 60 * 60 * 1000, // Cookie有效期与JWT有效期一致 (1天)
      secure: process.env.NODE_ENV === 'production', // 仅在生产环境使用HTTPS时发送
      sameSite: 'Lax', // 跨站请求策略，防止CSRF
    });

    res.redirect(origin); // 重定向回客户端应用
  } catch (error) {
    console.error('Google OAuth callback error:', error);
    res.status(500).send('Authentication failed.');
  }
});

// 注销端点
app.post('/logout', (req, res) => {
  // 清除用于维持用户会话的Cookie
  res.clearCookie('token', {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'Lax',
  });
  res.status(200).send({ message: 'Logged out successfully' });
});

// 示例受保护路由
app.get('/protected', (req, res) => {
  const token = req.cookies.token;
  if (!token) {
    return res.status(401).send('Unauthorized: No token provided');
  }

  try {
    const decoded = jwt.verify(token, secret);
    res.status(200).send(`Welcome, ${(decoded as any).displayName}! This is protected content.`);
  } catch (error) {
    res.status(401).send('Unauthorized: Invalid token');
  }
});

const PORT = process.env.PORT || 8000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});