passport-jwt总是返回'Unauthorized‘- 401

Question

我试图在我的应用程序中执行社交身份验证，为此我使用了两个模块: passport-google-oauth-20和passport-jwt。

当用户成功登录与谷歌帐户，我创建了一个令牌，并发送到标题作为一个持有者令牌与“授权”标题类型。

问题是:当我试图访问一些受保护的路由时，总是返回未授权。似乎没有调用passport.authenicate('jwt')。

下面是我的代码：

const express = require('express')
const JwtStrategy = require('passport-jwt').Strategy
const ExtractJwt = require('passport-jwt').ExtractJwt
const GoogleStrategy = require('passport-google-oauth20').Strategy
const passport = require('passport')
const morgan = require('morgan')
const moment = require('moment')
const db = require('./configs/database')
const User = require('./models/user')
const PORT = (process.env.PORT || 8080)
const jwt = require('jsonwebtoken')
const app = express()

app.set(db)
app.use(morgan('dev'))
app.use(function(req, res, next) {  
    res.header("Access-Control-Allow-Origin", "*");
    res.header('Access-Control-Allow-Methods', 'PUT, GET, POST, DELETE, OPTIONS');
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization, Access-Control-Allow-Credentials");
    res.header("Access-Control-Allow-Credentials", "true");
    next();
  });




//passport setup
let opts = {}
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken()
opts.secretOrKey = 'shhhhhhhhhhhh'

passport.use('jwt', new JwtStrategy(opts, function(jwt_payload, done){
    User.findById(jwt_payload.user._id, (err, user)=>{
        if(user){
            return done(null, user)
        } else{
             return done(null, false)
        }
        if(err){
            return done(err, false)
        }
    })
}))

passport.use(new GoogleStrategy({
    clientID: '',
    clientSecret: '',
    callbackURL: "http://localhost:8080/auth/google/callback"
  },
  function(accessToken, refreshToken, profile, cb) {

    User.findOne({'google.id': profile.id }, function (err, user) {
        if(user){
            return cb(null, user)
        }
        else{
            let newUser = {
                'google.id':profile.id,
                'google.name':profile.displayName,
                'google.token':accessToken
            }
            User.create(newUser, (err, user)=>{
                return cb(null, user)
            })
        }
        if(err){
            return cb(err)
        }
    });
  }
));


app.get('/auth/google',
passport.authenticate('google', { scope: ['profile','email'] }));


app.get('/auth/google/callback', 
passport.authenticate('google', { failureRedirect: '/login', session:false}),
    (req, res) => {
    console.log(req.user._id)
    let token = jwt.sign({id:req.user._id, user:req.user, sucess:true}, 'shhhh',{expiresIn:36000})
    res.json({token:'Bearer ' + token})
});


app.get('/dashboard', passport.authenticate('jwt', { session: false }), function(req, res) {  
    res.json({message:'worked', user:req.user})
  });



app.listen(PORT, () => {
    console.log(`Server running on PORT ${PORT}. At: ${moment().format('LT')}`)
})

Answer 1

https://stackoverflow.com/a/46020083/4548946

如果您使用的是ExtractJwt.fromAuthHeaderAsBearerToken()，则标头应包含'Authorization‘=’承载token_received_on_login‘

Answer 2

对于将来遇到这种情况的任何其他人，如我最近所做的，您必须初始化passport：

在基于连接或快速的应用程序中，需要使用passport.initialize()中间件来初始化Passport。如果您的应用程序使用持久登录会话，则还必须使用passport.session()中间件。

http://www.passportjs.org/docs/configure/