express框架中使用jwt实现验证的方法

npm i passport-jwt jsonwebtoken

// ./config.jsmodule.exports = { secretKey: '12345-67890-9876-54321', mongoUrl: 'mongodb://localhost:27017/confusion'}

var config = require('./config')...const url = config.mongoUrlconst connet = mongoose.connect(url, {useNewUrlParse: true, useCreateIndex: true})

./authenticate.jsvar passport = require('passport'), LocalStrategy = require('passport-local').Strategy, User = require('./models/user')var JwtStrategy = require('passport-jwt').Strategy, ExtractJwt = require('passport-jwt').ExtractJwt, jwt = require('jsonwebtoken')var config = require('./config.js')passport.use(new LocalStrategy(User.authenticate()))passport.serializeUser(User.serializeUser())passport.deserializeUser(User.deserializeUser())exports.getToken = function (user) { return jwt.sign(user, config.secretKey, {expiresIn: 3600}) // 签发token时设置超时时间是3600s}var opts = {}opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken() // 从验证头中提取，模型默认是`'bearer'`.opts.secretOrKey = config.secretKeyexports.jwtPassport = passport.use(new JwtStrategy(opts, (jwt_payload, done) => { console.log('JWT payload: ', jwt_payload) User.findOne({_id: jwt_payload._id}, (err, user) => { if (err) { return done(err, false) } else { if (user) { return done(null, user) } else { return done(null, false) } } })}))exports.verifyUser = passport.authenticate('jwt', {session: false}) // 使用jwt就不再需要session保存用户数据了。

// routes/users.js...var authenticate = require('../authticate')router.post('/login', passport.authenticate('local'), (req, res) => { // 登录时还是使用passport-local var token = authenticate.getToken({_id: req.user._id}) // 得到签发后的jwt res.statusCode = 200 res.setHeader('Content-Type', 'application/json') res.json({success: true, token: token, status: 'You are successful logged in!'})})

// use localStorage$.ajax({ type: 'post', dataType: 'json', url: 'users/login', data: { username: 'un', password: 'pw' }, success: funciton (res) { localStorage.token = getToken(res) }, error: funciton (err) {...}})// 还可以使用vux方法。// 还可以使用封装axios方法。

err = { name: 'TokenExpiredError', massage: 'jwt expired', expired: [ExpDate]}JsonWebTokenError

err = { name: 'JsonWebTokenError', message: 'jwt malformed' // 'jwt malformed', 'jwt signature in required', 'invalid signature', 'jwt audience invalid. expected: [OPTIONS AUDIENCE]', 'jwt issuer invalid. expected: [OPTIONS ISSUER]', 'jwt id invalid. expected:[OPTIONS JWT ID]', 'jwt subject invalid. expected: [OPTIONS SUBJECT]'}

err = { name: 'NotBeforeError', message: 'jwt not active', date: 2018-10-04T16:10:44.000Z}

// authenicate.js...export.verifyUser = passport.authenticate('jwt', { session: false, failureRedirect: '/error/auth' // 在这个路由里统一处理验证不通过的事情 })

// routes/error.js...router.get('/auth', (req, res, next) => { let header = req.headers let rawToken = header.authorization if (!rawToken.split(' ').length) { res.json({ // 统一的数据结构方便前端使用 code: 403, data: {}, message: 'error for get token' }) } else { let token = rawToken.split(' ')[1] jwt.verify(token, config.secretKey, err => { // 这里用到jsonwebtoken/config。注意引用 switch (err.name) { case 'TokenExpiredError': case 'NotBeforeError':  let payload = jwt.decode(token)  token = authenticate.getToken({_id: payload._id})  res.statusCode = 200  res.setHeader('Content-Type', 'application/json')  res.json({success: true, token: token, status: '已经刷新token'})  break case 'JsonWebTokenError': default:  res.statusCode = 401  res.json({  code: 401,  data: {  error: err  },  message: 'token错误'  })  break } }) } })