express-如何在对API的请求中读取HttpOnly cookie？

Question

当用户登录时，我在响应中发回一个HttpOnly cookie。

但是，当我随后对API进行调用时尝试读取cookie时，没有任何作用

这是我制作Cookie的方式：

var signOptions = {
    expiresIn: '30d',
    algorithm: 'RS256'
  }
  var CurrentDate = new Date()
  CurrentDate.setMonth(CurrentDate.getMonth() + 1)
  var cookieOptions = {
    httpOnly: true,
    expires: CurrentDate
  }

  const token = jwt.sign({ _id: user._id },
    fs.readFileSync(path.resolve('routes/keys/private.key'), 'utf8'),
    signOptions)

  res.status(200).cookie('stickyAccessJwt', token, cookieOptions).send('well done')

路线（“ /测试”）：

const express = require('express')
const router = express.Router()
const { CheckAuthorisation } = require('./middleware/checkAuthorisation')

router.get('/', CheckAuthorisation, async (req, res) => {
  res.send(':)')
})

module.exports = router

中间件（此处到达401）：

let checkAuthorisation = (req, res, next) => {
  var userJWT = req.cookies.stickyAccessJwt
  if (!userJWT) {
    res.status(401).send('Invalid or missing authorization token')
  } else {
    // 2. There's a token; see if it is a valid one and retrieve the payload

    var verifyOptions = {
      expiresIn: '30d',
      algorithm: ['RS256']
    }

    const userJWTPayload = jwt.verify(
      userJWT,
      fs.readFileSync(path.resolve('routes/keys/private.key'), 'utf8'),
      verifyOptions)

    if (!userJWTPayload) {
      // Kill the token since it is invalid
      res.clearCookie('stickyAccessJwt')
      res.status(401).send('Kill the token since it is invalid')
    } else {
      // 3. There's a valid token...see if it is one we have in the db as a logged-in user
      User.findOne({ '_id': userJWTPayload._id })
        .then(function (user) {
          if (!user) {
            res.status(401).send('User not currently logged in')
          } else {
            console.log('Valid user:', user.email)
            next()
          }
        })
    }
  }
}

这是我的index.js

const Joi = require('joi')
Joi.objectId = require('joi-objectid')(Joi)
const bodyParser = require('body-parser')
const cors = require('cors')
const cookieParser = require('cookie-parser')
const mongoose = require('mongoose')
const express = require('express')
const app = express()
const register = require('./routes/register')
const login = require('./routes/login')
const test = require('./routes/test')

mongoose.connect('mongodb://localhost/stickywall', { useNewUrlParser: true })
  .then(() => console.log('Now connected to MongoDB!'))
  .catch(err => console.error('Something went wrong', err))
mongoose.set('useCreateIndex', true)

app.use(cors())
app.use(cookieParser())
app.use(express.json())
app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: true }))
app.use('/register', register)
app.use('/login', login)
app.use('/test', test)

const port = process.env.PORT || 4000
app.listen(port, () => console.log(`Listening on port ${port}...`))

我不明白为什么req.cookies为空，我缺少什么吗？

Answer 1

const token = req.body.token ||
    req.query.token ||
    req.headers['x-access-token'] ||
    req.cookies.token;

if (!token) {
   res.sendStatus(401)
}

Answer 2

res.cookie([ JWT_TOKEN=Bearer ${token}; secure; httponly; samesite=Strict;， ])

1. 首先要安装 cookie-parser 库，它是一个中间件，因此 express 可以以某种方式管理 cookie：

$ npm install cookie-parser

2. 然后去配置 Express 应用程序并将 cookie 解析器库添加为中间件

$const express = require('express');
$const cookieParser = require('cookie-parser');
$app.use(cookieParser());

3.现在我们的 Express 应用程序可以为我们完成所有的 cookie 解析工作！

req.cookies.JWT_TOKEN

4. 在前面，如果你使用axios，你必须始终在配置中设置“withCredentials: true”，

const config = { headers: { 'Content-Type': 'application/json', },withCredentials: true,}

axios
  .post(
    'http://localhost:3008/api/auth/login',
    {
      username: target.username.value,
      password: target.password.value,
    },
    config
  )
  .then((data) => JSON.stringify(data, null, 2))
  .then((result) => console.log(result))
  .catch((err) => console.log('[Control Error ] ', err))

}`

！！！ HTTP cookie 在所有请求中自动发送到服务器。结束