2

我想忽略一些针对令牌身份验证进行检查的 API URL

我想保护 post 和 put 方法，但不想得到这个 url

本地主机：3000/api/事件/

router.use(function(request, response) {
    var token = request.body.token || request.query.token || request.headers['x-access-token'];
    if (token) {
        jwt.verify(token, app.get(superSecret), function(err, decoded) {
            if (err)
                return response.json({
                    sucess: false,
                    message: "Failed token Authentication"
                });
            else {
                request.decoded = decoded;
                next();
            }

        });
    } else {
        return response.status(403).send({
            success: false,
            message: 'No token provided.'
        });

    }

});

如何在 node,express 中使用 jsonwebtoken 执行此操作

我希望这仅适用于发布、放置、删除请求，但不适用于获取请求。

4

2 回答 2

0

您可以将匿名中间件移动到正常声明的函数，然后将其传递给所有受保护的路由（您决定要保护哪个路由！）

您的代码可能如下所示：

function tokenProtection(request, response, next) {
    var token = request.body.token || request.query.token || request.headers['x-access-token'];
    if (token) {
        jwt.verify(token, app.get(superSecret), function(err, decoded) {
            if (err)
                return response.json({
                    sucess: false,
                    message: "Failed token Authentication"
                });
            else {
                request.decoded = decoded;
                next();
            }

        });
    } else {
        return response.status(403).send({
            success: false,
            message: 'No token provided.'
        });

    }

}

现在您的路线可能看起来像（您决定要保护什么）：

router.get('/item', function(req, res) { ... }); // not protected
router.get('/item/:id', function(req, res) { ... }); // not protected
router.post(tokenProtection,'/item', function(req, res) { ... });//protected
router.put(tokenProtection,'/item', function(req, res) { ... });//protected

router.get('/book', function(req, res) { ... });// not protected
router.get('/book/:id', function(req, res) { ... });// not protected
router.post(tokenProtection,'/book', function(req, res) { ... });//protected
router.put(tokenProtection,'/book', function(req, res) { ... });//protected
于 2016-03-09T19:06:25.783 回答
0

将您想要保护的路由放在您的身份验证路由下方，您不想保护的路由可以放在身份验证路由上方。像这样的东西，

    // Require what will be needed 
    var express  =  require('express'),
    User     =  require('../models/user'),
    usersRouter   =  express.Router();

    var jwt    = require('jsonwebtoken'); // used to create, sign, and verify tokens
    var config = require('./config'); // get our config file

    var secret = {superSecret: config.secret}; // secret variable,

    // Create a new user and return as json for POST to '/api/users'
    usersRouter.post('/', function (req, res) {
      var user = new User(req.body);
      user.save(function(){ //pre-save hook will be run before user gets saved. See user model.
        res.json({user : user, message: "Thank You for Signing Up"});

      });
    });

    usersRouter.post('/authentication_token', function(req, res){
      var password = req.body.password;
      // find the user
        User.findOne({
          email: req.body.email
        }, function(err, user) {
          //If error in finding the user throw the error
          if (err) throw err;
          //If there is no error and the user is not found.
          if (!user) {
            res.json({ success: false, message: 'Authentication failed. User not found.' });
            //if the user is found
          } else if (user) {
            // check if password matches
            user.authenticate(password, function(isMatch){
              if(isMatch){
                // if user is found and password is right
                // create a token with full user object. This is fine because password is hashed. JWT are not encrypted only encoded.
                var token = jwt.sign({email: user.email}, secret.superSecret, {
                  expiresIn: 144000 
                });
                // set the user token in the database
                user.token = token;
                user.save(function(){
                  // return the information including token as JSON
                  res.json({
                    success: true,
                    id: user._id,
                    message: 'Enjoy your token!',
                    token: token
                  });
                });
              } else {
                res.json({ success: false, message: 'Authentication failed. Wrong password.' });
              }
            });
          }
        });
      });

//***********************AUTHENTICATED ROUTES FOR USERS******************************

      // Return ALL the users as json to GET to '/api/users'
    usersRouter.get('/', function (req, res) {
      User.find({}, function (err, users) {
        res.json(users);
      });
    });

    // Export the controller
    module.exports = usersRouter;

实际上，我昨天在我的博客上解释了这一点，因为我很难弄清楚。如果你还不清楚，可以看这里，Node API Authentication with JSON Web Tokens - the right way。

如果有像我这样的其他资源，那就是计划。下面是我为我想要验证的计划放在所有路线之上的代码。

    // route middleware to verify a token. This code will be put in routes before the route code is executed.
PlansController.use(function(req, res, next) {

  // check header or url parameters or post parameters for token
  var token = req.body.token || req.query.token || req.headers['x-access-token'];

  // If token is there, then decode token
  if (token) {

    // verifies secret and checks exp
    jwt.verify(token, secret.superSecret, function(err, decoded) {
      if (err) {
        return res.json({ success: false, message: 'Failed to authenticate token.' });
      } else {
        // if everything is good, save to incoming request for use in other routes
        req.decoded = decoded;
        next();
      }
    });

  } else {

    // if there is no token
    // return an error
    return res.status(403).send({
        success: false,
        message: 'No token provided.'
    });

  }
});
    //***********************AUTHENTICATED ROUTES FOR PLAN BELOW******************************
PlansController.get('/', function(req, res){
  Plan.find({}, function(err, plans){
  res.json(plans);
  });
});
于 2016-03-11T15:43:08.780 回答