問題描述

我正在嘗試實(shí)現(xiàn) JWT 身份驗(yàn)證./login 和/register 工作正常，它們返回身份驗(yàn)證令牌，但是當(dāng)我嘗試使用標(biāo)頭 'Authorization' = 'JWT token_received' 獲取/secret 時(shí)，它返回一個(gè)字符串'unauthorized'，我看不到來自 JWTStrategy 的日志記錄.請(qǐng)讓我知道我哪里出錯(cuò)了.

I am trying to implement JWT authentication. /login and /register work fine and they return authentication token, but when I try to GET /secret with a header 'Authorization' = 'JWT token_received', it returns a string 'unauthorized' and I can see no logging from JWTStrategy. Please let me know where I am going wrong.

var opts = {}
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
opts.secretOrKey = "very_secret"

passport.use(new JwtStrategy(opts, function(payload, next){
    console.log("payload received" + payload);
    User.findById(payload.id, function(err, user){
        console.log("user found:" + user);
        if(err){
            return next(err, false)
        }
        else if(user){
            return next(null, user)
        }
        else{
            return next(null, false)
        }
    });
    }
));

app.use(passport.initialize());

app.post("/login", function(req, res){

        var email = req.body.email;
        var password = req.body.password;

        var user = User.findOne({"email": email}, function(err, user){

        if(err){
            res.json({"error": err});
            return;
        }
        if(!user){
            res.json({"message": "No user found"});
            return;
        }
        if(user.password == password){
            res.json(
                { 
                    "message": "User found",
                    "token": jwt.sign({"id": user.id}, opts.secretOrKey)
                }
            );
        }
        else{
            res.json({"message": "Password did not match"});
        }
    });
});

app.post("/register", function(req, res){
new User({ email: req.body.email, password: req.body.password}).
    save(function(err, user){
            if(err){
                res.json({"message": "User cannot be created"});
            }
            else{
                res.json(
                    { 
                        "message": "ok",
                        "token": jwt.sign({"id": user.id}, opts.secretOrKey)
                    }
                );
            }
    });
});

app.get("/secret", passport.authenticate("jwt", {session: false}), function(req, res){
    console.log(req.get('Authorization'));
    res.json(req.user);
});

使用郵遞員作為客戶端.向郵遞員索取詳細(xì)信息，

Using postman as the client. Request details from postman,

GET /secret HTTP/1.1
Host: localhost:3000
Content-Type: application/x-www-form-urlencoded
Authorization: JWT token_I_received_on_login
Cache-Control: no-cache
Postman-Token: 114060a3-3074-6688-6245-0b0cfe7e9f04

推薦答案

知道了.請(qǐng)求中有錯(cuò)誤.

Got it. Made a mistake in the request.

根據(jù) README，應(yīng)該是 'Authorization' = 'bearer token_received_on_login'

As per the README, it should be 'Authorization' = 'bearer token_received_on_login'

這篇關(guān)于嘗試在節(jié)點(diǎn)中實(shí)現(xiàn) JWT 身份驗(yàn)證.在受保護(hù)的路線中獲得未經(jīng)授權(quán)的文章就介紹到這了，希望我們推薦的答案對(duì)大家有所幫助，也希望大家多多支持html5模板網(wǎng)！