Tl; dr

在本地（start:dev或start:prod中）一切正常，在我的服务器（start:dev或start:prod中）中，我的jwt验证不起作用。我拿回了令牌，但是如果我在受保护的路由中对其进行测试，则会得到401 ...

日志

一些日志（在产品中）。

1-我在domain.dev/api/hello中通过邮递员发送获取请求

Request Headers
  User-Agent: "PostmanRuntime/7.19.0"
  Accept: "*/*"
  Cache-Control: "no-cache"
  Postman-Token: "3940ba0e-3c60-4746-bb12-e06bf01df0bf"
  Host: "domain.dev"
  Accept-Encoding: "gzip, deflate"
  Connection: "keep-alive"
Response Headers
  Date: "Sun, 27 Oct 2019 20:54:35 GMT"
  Server: "Apache/2.4.25 (Debian)"
  X-Powered-By: "Express"
  Access-Control-Allow-Origin: "*"
  Content-Type: "text/html; charset=utf-8"
  Content-Length: "12"
  ETag: "W/"c-Lve95gjOVATpfV8EL5X4nxwjKHE""
  Keep-Alive: "timeout=5, max=100"
  Connection: "Keep-Alive"
Response Body
  Hello World!

服务器响应，好吧！

2-我通过domain.dev/api/auth发送邮件请求（通过邮递员）

Request Headers
  Content-Type: "application/json"
  User-Agent: "PostmanRuntime/7.19.0"
  Accept: "*/*"
  Cache-Control: "no-cache"
  Postman-Token: "4391992e-788c-4780-b188-833999383704"
  Host: "alanbouteiller.dev"
  Accept-Encoding: "gzip, deflate"
  Content-Length: 45
  Connection: "keep-alive"
Request Body
  name: "Hadock"
  password: "XXXXXX"
Response Headers
  Date: "Sun, 27 Oct 2019 20:57:14 GMT"
  Server: "Apache/2.4.25 (Debian)"
  X-Powered-By: "Express"
  Access-Control-Allow-Origin: "*"
  Content-Type: "application/json; charset=utf-8"
  Content-Length: "212"
  ETag: "W/"d4-XWUV7P7Ft81OyIDhImoZoNDfnsA""
  Keep-Alive: "timeout=5, max=100"
  Connection: "Keep-Alive"
Response Body
  access_token: 
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSGFkb2NrIiwic3ViIjoiNWQ4YTFmZGIyMDc3NTU0NjlmMjgzNDNlIiwiaWF0IjoxNTcyMjEwMDY3LCJleHAiOjE1NzIyMTAxODd9.hoe69wy86XXXXXXXXXXXXXghGVw8TEKmOA"

服务器向我发送此日志（通过pm2）：

在代码中，每个日志对应于：

红色-> auth.controller.ts

// give the jwt
@Post()
async login(@Request() req): Promise<any> {
    console.log(req.body); // the red
    return await this.authService.login(req.body);
}

橙色，绿色，蓝色和紫色-> auht.service.ts

@Injectable()
export class AuthService {
    constructor(
        @InjectModel('Author') private readonly authorModel: Model<AuthorInterface>,
        private readonly authorService: AuthorService,
        private readonly jwtService: JwtService,
    ) {}

    // check if user exist in db, if is return user
    async validateUser(name: string): Promise<any> {
        const user = await this.authorService.getAuthorByName(name);
        console.log(user); // orange 1
        if (user.length !== 0) {
            console.log({status: true, data: user[0]}); // orange 2
            return {status: true, data: user[0]};
        } else {
            return {status: false, data: 'no user with this name'};
        }
    }

    // check user and return token if user is valid
    async login(author: any) {
        const check = await this.validateUser(author.name);
        console.log(check); // orange 3
        if (check.status) {
            console.log(author.password); // green
            console.log(check.data.password); // green
            const compare = await bcrypt.compare(author.password, check.data.password);
            if (!compare) {
                // if check is not ok
                return {status: false, message: 'bad credential'};
            } else {
                // generate jwt payload
                const payload = {name: author.name, sub: check.data._id};
                console.log(payload); // blue
                const jwt = this.jwtService.sign(payload);
                console.log(jwt); // purple
                // save in db
                await this.authorModel.updateOne({_id: check.data._id}, {$set: {token: jwt}});
                // return
                return {access_token: jwt};
            }
        } else {
            return {status: false, message: 'no user found'};
        }
    }
}

一切看起来都很好...令牌在数据库和响应中都是相同的。

但是；我在jwt.strategy.ts中验证的函数永远不会调用：

import { ExtractJwt, Strategy } from 'passport-jwt';
import { PassportStrategy} from '@nestjs/passport';
import {Injectable, UnauthorizedException} from '@nestjs/common';
import { ConfigService } from '../conf/config.service';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
    constructor(env: ConfigService) {
        super({
            // which the jwt is extracted
            jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
            // the password module check the expiration, this class no
            ignoreExpiration: false,
            secretOrKey: env.get('secret'),
        });
    }

    // this function is call automatically by the @UseGuards(AuthGuard('jwt'))
    async validate(payload: any) {
        console.log('----------validate');
        console.log(payload);
        console.log({ username: payload.name, userId: payload.sub, timeStamp: new Date() });
        return !payload ? new UnauthorizedException() : { username: payload.name, userId: payload.sub, timeStamp: new Date() };
    }
}

console.log在日志中不可见，而在本地使用相同文件的情况是这样：

// LOCAL LOG WHIT THE SAME BUILD FOLDER
{ name: 'hadock', password: 'test' }
[
  {
    _id: 5d7e6520c7e8fb43fcb1a1e5,
    name: 'hadock',
    password: '$2b$12$f8bUfYwr7jjPlDuIrKVtzuKMZRVVRWjUUIOJpdSaeoFv4PN5XQ57q',
    __v: 0,
    token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiaGFkb2NrIiwic3ViIjoiNWQ3ZTY1MjBjN2U4ZmI0M2ZjYjFhMWU1IiwiaWF0IjoxNTcyMTc2ODkxLCJleHAiOjE1NzIxNzcwMTF9.8RnXXXXXXXX2rjwXs'
  }
]
{
  status: true,
  data: {
    _id: 5d7e6520c7e8fb43fcb1a1e5,
    name: 'hadock',
    password: '$2b$12$f8bUfYwr7jjPlDuIrKVtzuKMZRVVRWjUUIOJpdSaeoFv4PN5XQ57q',
    __v: 0,
    token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiaGFkb2NrIiwic3ViIjoiNWQ3ZTY1MjBjN2U4ZmI0M2ZjYjFhMWU1IiwiaWF0IjoxNTcyMTc2ODkxLCJleHAiOjE1NzIxNzcwMTF9.8RnXXXXXXXX2rjwXs'
  }
}
{
  status: true,
  data: {
    _id: 5d7e6520c7e8fb43fcb1a1e5,
    name: 'hadock',
    password: '$2b$12$f8bUfYwr7jjPlDuIrKVtzuKMZRVVRWjUUIOJpdSaeoFv4PN5XQ57q',
    __v: 0,
    token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiaGFkb2NrIiwic3ViIjoiNWQ3ZTY1MjBjN2U4ZmI0M2ZjYjFhMWU1IiwiaWF0IjoxNTcyMTc2ODkxLCJleHAiOjE1NzIxNzcwMTF9.8RnXXXXXXXX2rjwXs'
  }
}
test
$2b$12$f8bUfYwr7jjPlDuIrKVtzuKMZRVVRWjUUIOJpdSaeoFv4PN5XQ57q
{ name: 'hadock', sub: 5d7e6520c7e8fb43fcb1a1e5 }
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiaGFkb2NrIiwic3ViIjoiNWQ3ZTY1MjBjN2U4ZmI0M2ZjYjFhMWU1IiwiaWF0IjoxNTcyMjEyNDI5LCJleHAiOjE1NzIyMTI1NDl9.MrjXXXXXXXXX4NLFNw
----------validate
{
  name: 'hadock',
  sub: '5d7e6520c7e8fb43fcb1a1e5',
  iat: 1572212429,
  exp: 1572212549
}
{
  username: 'hadock',
  userId: '5d7e6520c7e8fb43fcb1a1e5',
  timeStamp: 2019-10-27T21:40:47.206Z
}

Answer 1

我相信您需要共享更多代码，但无论如何我都会加2美分。在这里，我们看到您正在添加一堆CORS标头，这很好，在您使用反向代理访问同一Web服务器时，似乎并没有必要。现在，您的问题似乎出在应用程序的JWT验证部分。

通常，对于JWT身份验证，身份验证服务器（您的API）会创建一个具有秘密的JWT（对称或非对称），并将其返回给使用者以用于将来的API调用。我看到您正在通过Authorization标头正确传递它。现在，您的问题可能在验证的后端。您需要一个中间件，该中间件检查Authorization标头，删除其中的 Bearer 部分（包括空格），然后利用您的公共密钥（非对称）或私有密钥（对称）并计算是否或不是有效的JWT，如果有效则继续，否则拒绝。

请随时在这里回复，我会尽可能地回复。您肯定需要共享您的整个请求以及chrome记录的整个响应，请检查“网络”标签。

Nestjs Prod JWT auth在本地但不在服务器上工作

Tl; dr

日志

1 个答案: