Question

我正在尝试通过使用带有护照JwtStrategy的JSON Web令牌来测试对特定路由的GET请求是否受到保护;但是，我的passport.use文件中的server.js中间件函数似乎没有执行。我在那里的console.log从未出现在我的shell /终端中。我的登录路由有效，但不是配置文件路由。我正在使用邮递员，我输入了http://localhost:3000/profile用于GET方法，在Headers标签中我选择了授权密钥和值我复制并粘贴了长JSON网络令牌字符串，但它一直在说未经授权。那是因为我的passport.use功能永远不会被执行。

// Server.js文件

var JwtStrategy = require("passport-jwt").Strategy;
var ExtractJwt = require("passport-jwt").ExtractJwt;

var User = require("../models/user");
var config = require('./secret');

app.use(passport.initialize());
app.use(passport.session());

let options = {};
//pass token back and forth
options.jwtFromRequest = ExtractJwt.fromAuthHeader();
options.secretOrKey = config;
passport.use(new JwtStrategy(options, (jwt_payload, done) => {
  *******************************************
  //this console log doesn't show up in shell which makes be believe its never getting here
  *******************************************
  console.log("JWT PAYLOAD", jwt_payload)
  User.getUserById(jwt_payload._id, (err, user) => {
    if(err){
      return done(err, false);
    }

    if(user){ //null for error
      return done(null, user);
    }else{
      return done(null, false);
    }
  });
}));

//路由调用passport.authenticate回调的文件

var passport = require('passport');
var jwt = require('jsonwebtoken');
var secret = require('../config/secret')

var User = require('../models/user');

router.post('/login', (req, res) => {
    var username = req.body.username;
    var password = req.body.password;
    console.log("SECRET2", secret);
    console.log("SECRET", secret.secret);
    User.getUserByUsername(username, (err, user) => {
        if(err){
            throw err;
        }
        if(!user){
            return res.json({ success: false, msg: "User not found"});
        }

        User.comparePassword(password, user.password, (err, isMatch) => {
            if(err){
                throw err;
            }
            if(isMatch){
                var token = jwt.sign(user, secret.secret, {
                    expiresIn: 604800 //1 week in seconds, token expires and requires to log back in
                });

                console.log('TOKEN IN LOGIN ROUTE', token)

                res.json({
                    //tokens are then stored in local storage or cookie
                    success: true,
                    token: 'JWT ' + token,
                    user: {
                        id: user._id,
                        name: user.name,
                        username: user.username,
                        email: user.email
                    }
                });
            }else{
                return res.json({ success: false, msg: "Incorrect password"});
            }
        });
    });
});

router.get('/profile', passport.authenticate('jwt', {session:false}), (req, res) => {
    res.json({user: req.user});
});

//用户模型

var mongoose = require('mongoose');
var bcrypt = require('bcryptjs');

var Schema = mongoose.Schema;

var UserSchema = new Schema({
  name: {
    type: String,
    trim: true,
    required: "First Name is Required"
  },
  email: {
    type: String,
    required: true
  },
  username: {
    type: String,
    required: true
  },
  password: {
    type: String,
    required: true
  }
});

var User = mongoose.model("User", UserSchema);

module.exports = User;

//Alternate syntax for exporting Schema
// var User = module.exports = mongoose.model("User", UserSchema);

module.exports.getUserById = function(id, callback){
    User.findById(id, callback);
}

module.exports.getUserByUsername = function(username, callback){
    var query = { username: username }
    User.findOne(query, callback);
}

//Custom User model function that will take in the newUser object and hash the password.
module.exports.addUser = function(newUser, callback){
    bcrypt.genSalt(10, (err, salt) => {
        bcrypt.hash(newUser.password, salt, (err, hash) => {
            if(err){
                throw err
            }

            newUser.password = hash;
            newUser.save(callback);
        });
    });
}

module.exports.comparePassword = function(password, hash, callback){
    bcrypt.compare(password, hash, (err, isMatch) => {
        if(err){
            throw err
        }
        callback(null, isMatch);
    });
}

更新：在JWT＆＃39; JWT＆＃39;之后我尝试了一个空间。 in为邮递员中的授权值，但它仍然不起作用，并且控制台日志未显示。是因为我不知道导出或链接我在passport.use中定义的server.js我的GET＆＃39; /个人资料＆＃39;在我的路线文件中路由？

更新2：添加了模型和登录路线

Answer 1

也许有必要包含更多代码来查看您的问题，但似乎策略未正确导出。当您创建新策略时，您可以添加“别名”＃39;在入口点使用它：

passport.use('local-login', new JwtStrategy(options, (jwt_payload, done) => {
    ....
}

router.get('/profile', passport.authenticate('local-login', {session:false}), (req, res) => {
    res.json({user: req.user});
});

护照身份验证回调未调用护照中间件

1 个答案: