尝试在 NodeJS 上开发我的 API,我得到了我的签名令牌并将其发送回安全的 api 路由,但 jwt 永远不会有效,即使它与我生成的令牌相同!我的代码有什么问题?
我是那样做的
pbkdf2(queryPassword, salt, 10000, length, digest, (err: Error, hash: Buffer) => {
if (hash.toString('hex') === userPassword) {
sign({'user': username, permissions: []}, secret, {expiresIn: '7d'}, (err, token => {
response.json({'token': token});
}));
} else {
response.json({'error': 'User / Password Mismatch'});
}
});
这是验证:
verify(token, secret, function(tokenError, decoded) {
if (tokenError) { // i'm always getting error...
return response.status(403).json({
message: 'Invalid token, please Log in first'
});
}
next();
});
这是我的 Angular2 服务,它从我的 API 请求数据
let headers = new Headers({'Authorization': 'Bearer ' + this.token});
let options = new RequestOptions({headers: headers});
this.http.get(apiUrl, options);
由符号生成的令牌:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoidHQiLCJwZXJtaXNzaW9ucyI6W10sImlhdCI6MTQ4MzExNTAzNCwiZXhwIjoxNDgzNzE5ODM0fQ.bJbH4619JAU8pf_6qcYl0VPB6VleV5
http 服务收到的令牌:
承载 eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoidHQiLCJwZXJtaXNzaW9ucyI6W10sImlhdCI6MTQ4MzExNTAzNCwiZXhwIjoxNDgzNzE5ODM0fQ.bJbH4619JAU8pf_6qPBRYeXb0V10s