无法通过邮递员使用承载令牌访问nodejs中的受保护路由

Question

我试图使用get request将bearer token发送到受保护的路由，即使在通过标头发送令牌之后也会返回unautorized。

我正在使用nodejs上的承载令牌，使用mlab数据库的高速公路应用程序我注册了新用户，然后我登录了那封电子邮件，它给我送回了一个令牌(正如预期的那样)。

当我在没有登录的情况下通过其他路由的头发送此令牌时，它返回Unautorized。

我的脚步是

1)使用新电子邮件注册

​

​

2)登录请求成功

​

​

3)失败的get request路由localhost:5000/api/users/current，并返回未自动化。

​

​

user.js文件

// users.js for authentication and authorization

const express = require("express");
const router = express.Router();
const gravatar = require("gravatar");
const bcrypt = require("bcryptjs");
const keys = require("../../config/keys");
const jwt = require("jsonwebtoken");
const passport = require("passport");

// Load User Model to check existing email is used for registration or not?
const User = require("../../models/User");

// @route       GET request to api/users/test
// @description Tests users route
// @access      Public, without login
router.get("/test", (req, res) => res.json({ msg: "Users Works" }));

// @route       GET request to api/users/register
// @description new registration of user.
// @access      Public, without login first register

router.post("/register", (req, res) => {
  User.findOne({ email: req.body.email }).then(user => {
    if (user) {
      return res.status(400).json({ email: "Email value exists already." });
    } else {
      console.log("no user found of this email in DB");
      const avatar = gravatar.url(req.body.email, {
        s: "200", //Size of gravatar in pixels
        r: "pg", //rating,
        d: "mm" //default value= 'mm'
      });
      // create user
      const newUser = new User({
        name: req.body.name,
        email: req.body.email,
        avatar,
        password: req.body.password
      });

      // gensalt(noOfSalts_of_Iterations,(err,salt_result)=>{})
      bcrypt.genSalt(10, (err, salt) => {
        // hash(plaintext,salt,callback(err,resultant ciphertext))
        bcrypt.hash(newUser.password, salt, (err, hash) => {
          if (err) {
            console.log("error in bcrypt.hash()");
            throw err;
          }
          //assign salted hash to password
          newUser.password = hash;

          // Save new password in datebase, overriding plaintext;
          newUser
            .save()
            .then(user => res.json(user)) // if yes,then send it as argument in brackets.
            .catch(err =>
              console.log("Error occured in saving hash password in DB\n")
            );
        });
      });
    }
  });
});

// @route       GET request to api/users/login
// @description Login/signing-in registered user. return JWT token
// @access      Public

router.post("/login", (req, res) => {
  const email = req.body.email;
  const password = req.body.password;

  // find user to match it's password
  User.findOne({ email: req.body.email }).then(user => {
    //check if no user
    if (!user) {
      return res.status(404).json({ email: "User's email   found." });
    }

    // else if do this..

    // if user's email-id is found then match it's password-hash with local-database
    bcrypt.compare(password, user.password).then(isMatch => {
      if (isMatch) {
        // user pswd matched => then return JWT token back for authentication
        // res.json({ msg: "Success" });
        const payload = { it: user.id, name: user.name, avatar: user.avatar };

        // created JWT token
        // now sign token
        // jwt.sign(payload, secretKey, expire-time, callback );

        // jwt.sign

        jwt.sign(
          payload,
          keys.secretOrKey,
          { expiresIn: 3600 },
          (err, token) => {
            res.json({
              success: true,
              token: "bearer " + token
            });
          }
        );
      } else {
        // pswd doesn't matched
        return res.status(400).json({ password: "Password didn't match" });
      }
    });
  });
});

// @route       GET request to api/users/current  - current user with token
// @description Return current user
// @access      Private, can't go without login

router.get(
  "/current",
  passport.authenticate("jwt", { session: false }),
  (req, res) => {
    res.json({ msg: "Success" });
  }
);

module.exports = router;

数据成功地存储在远程db mlab中，但我无法指出问题所在。

​

我对这个项目的投资回报是这。

Answer 1

请查看代码Users.js行88的行，有效载荷id存储在“it”中。

const payload = { it: user.id, name: user.name, avatar: user.avatar };

但在你的passport.js里

User.findById(jwt_payload.id)

您正在按id提取它，所以如果您在这里使用jwt_payload.it，您将得到消息成功。