在/ api / protected中访问受保护的端点时，为什么会收到401未经授权的错误？

Question

我正在使用JWT生成用于访问控制的令牌。我可以按/ api / auth / login并获取令牌，但是，当尝试按GET请求访问/ api / protected时，我得到401 Unauthorized。

我仔细检查了一下，没有发现任何具体的东西，尽管这似乎是例行问题。我尝试在server.js文件中移动路由，看看是否是问题所在。我已经从路由中删除了前面的斜杠（从/ api / protected到api / protected），并使用后者，由于app.use（express.static .... 我正在使用邮递员进行测试，但不确定在这里缺少什么。我还确保在Postman中将授权设置为Bearer Token。

'use strict';
const { Strategy: LocalStrategy } = require('passport-local');

// Assigns the Strategy export to the name JwtStrategy using object destructuring
const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');

const { User } = require('../users/models');
const { JWT_SECRET } = require('../config');

const localStrategy = new LocalStrategy((username, password, callback) => {
  let user;
  User.findOne({ username })
    .then(_user => {
      user = _user;
      if (!user) {
        // Return a rejected promise so we break out of the chain of .thens.
        // Any errors like this will be handled in the catch block.
        return Promise.reject({
          reason: 'LoginError',
          message: 'Incorrect username or password'
        });
      }
      return user.validatePassword(password);
    })
    .then(isValid => {
      if (!isValid) {
        return Promise.reject({
          reason: 'LoginError',
          message: 'Incorrect username or password'
        });
      }
      return callback(null, user);
    })
    .catch(err => {
      if (err.reason === 'LoginError') {
        return callback(null, false, err);
      }
      return callback(err, false);
    });
});

const jwtStrategy = new JwtStrategy(
  {
    secretOrKey: JWT_SECRET,
    // Look for the JWT as a Bearer auth header
    jwtFromRequest: ExtractJwt.fromAuthHeaderWithScheme('Bearer'),
    // Only allow HS256 tokens - the same as the ones we issue
    algorithms: ['HS256']
  },
  (payload, done) => {
    done(null, payload.user);
  }
);

module.exports = { localStrategy, jwtStrategy };






'use strict';
//How does order of code affect how it works?
// YES
require('dotenv').config();
const express = require('express');
const mongoose = require('mongoose');
const morgan = require('morgan');
const passport = require('passport');
const path = require('path');
const { router: usersRouter } = require('./users');
const { router: authRouter, localStrategy, jwtStrategy } = require('./auth');


mongoose.Promise = global.Promise;

// Is this needed if dotenv is in this file also?
const { PORT, DATABASE_URL } = require('./config');

const app = express();

// Logging
app.use(morgan("common"));


// const logRequest = (req, res, next) => {
//   const now = new Date();
//   console.log(
//     `local log - ${now.toLocaleDateString()} ${now.toLocaleTimeString()} ${req.method} ${req.url}`
//   );
//   next();
// }

app.use(function (req, res, next) {
  res.header('Access-Control-Allow-Origin', '*');
  res.header('Access-Control-Allow-Headers', 'Content-Type,Authorization');
  res.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE');
  if (req.method === 'OPTIONS') {
    return res.send(204);
  }
  next();
});

passport.use(localStrategy);
passport.use(jwtStrategy);

//app.use(logRequest);
app.use(express.urlencoded({ extended: true }));
app.use(express.json());
app.use('/api/users/', usersRouter);
app.use('/api/auth/', authRouter);
app.use("/api/items", require('./routes/api/items'));

// protected route that needs a valid JWT for access
const jwtAuth = passport.authenticate("jwt", { session: false });



// route to handle static content ie.e *.jpg
app.use(express.static(path.join(__dirname, "client", "build")));

app.get('/api/protected', jwtAuth, (req, res) => {
  return res.json({
    data: 'Hello World'
  });
});



// have react client handle all additional routes
app.get("*", (req, res) => {
  res.sendFile(path.join(__dirname, "client", "build", "index.html"));
});

let server;
function runServer(DATABASE_URL, port = PORT) {
  return new Promise((resolve, reject) => {
    // How is DATABASE_URL used? What is the value? Is it referencing
    // DATABASE_URL?
    mongoose.connect(DATABASE_URL, { useNewUrlParser: true, useFindAndModify: false }, (err) => {
      console.log("Success");
      if (err) {
        return reject(err);
      }
      server = app.listen(port, () => {
        console.log(`Your app is listening on port ${PORT}`);
        resolve();
      })
        .on('error', (err) => {
          mongoose.disconnect();
          reject(err);
        });
    });
  });
}

function closeServer() {
  return mongoose.disconnect()
    .then(() => new Promise((resolve, reject) => {
      console.log("Closing server");
      server.close((err) => {
        if (err) {
          return reject(err);
        }
        resolve();
      });
    }));
}

if (require.main === module) {
  runServer(DATABASE_URL)
    .catch(err => console.error(err));
}

module.exports = { app, runServer, closeServer };

enter code here我希望返回一个字符串“ Hello World”，以确保我正确地到达了端点。相反，我收到401错误，即GET / api / protected HTTP / 1.1“ 401 enter code here