我们将hapi-auth-jwt2与jwks-rsa一起使用来解码和验证azureAD访问令牌。
这是我们的jwt策略，它在每条路线上都有效。
'use strict'
const jwt = require('hapi-auth-jwt2')
const jwksRsa = require('jwks-rsa')
const userCtrl = require('./../controllers/UserController')
const authHandler = require('./auth.factory').GetAuthHandler()
// TODO: Replace with current JSON web token formatting and active directory
module.exports = {
name: 'JWT Authentication',
register: async (server, options) => {
await server.register(jwt)
// Confirm that we are getting the correct PK
// const pk = await authHandler.GetPK()
const key = jwksRsa.hapiJwt2KeyAsync({
cache: true,
rateLimit: true,
jwksRequestsPerMinute: 5,
// jwksUri: 'https://YOUR_DOMAIN/.well-known/jwks.json'
jwksUri: 'https://login.microsoftonline.com/common/discovery/keys'
// https://login.microsoftonline.com/common/discovery/keys
// https://login.microsoftonline.com/common/.well-known/openid-configuration
})
server.auth.strategy('jwt', 'jwt', {
// Get the complete decoded token, because we need info from the header (the kid)
complete: true,
// Dynamically provide a signing key based on the kid in the header and the singing keys provided by the JWKS endpoint.
key: key,
// key: pk,
headerKey: 'authorization',
tokenType: 'Bearer',
validate: userCtrl.validate,
verifyOptions: {
algorithms: ['RS256'] // or HS256 RS256
}
})
server.auth.default('jwt')
console.log(key)
}
}
然后我们将Authorization标头（即'Bearer ' + accessToken）附加到http，并从locahost发出请求，即当前客户端/前端到/sso路由，服务器返回以下请求/响应
[1569928136140] INFO (11252 on PORT230): request completed
req: {
"id": "1569928136137:PORT230:11264:k17qg99b:10001",
"method": "get",
"url": "https://port230.5874.com/api/v2/user/sso",
"headers": {
"host": "port230.5874.com",
"connection": "keep-alive",
"accept": "application/json, text/plain, */*",
"origin": "http://localhost:8080",
"authorization": "Bearer ...",
"user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site",
"referer": "http://localhost:8080/",
"accept-encoding": "gzip, deflate, br",
"accept-language": "en-US,en;q=0.9"
}
}
res: {
"statusCode": 401,
"headers": {
"www-authenticate": "Bearer error=\"Invalid token\"",
"content-type": "application/json; charset=utf-8",
"vary": "origin",
"access-control-allow-origin": "http://localhost:8080",
"access-control-expose-headers": "WWW-Authenticate,Server-Authorization",
"strict-transport-security": "max-age=15768000",
"x-frame-options": "DENY",
"x-xss-protection": "1; mode=block",
"x-download-options": "noopen",
"x-content-type-options": "nosniff",
"cache-control": "no-cache",
"content-length": 106
}
}
responseTime: 3
响应包括"www-authenticate": "Bearer error=\"Invalid token\""。我们一直在尝试理解为什么出现Invalid Token错误，但没有成功。
有人会知道何时，为什么引发此错误以及可能如何克服它吗？