为了使 JWT 失效,人们使用两种方法之一
- 黑名单/白名单(带有 Guardian_db)。
- 一个刷新令牌(允许重新生成访问令牌)和一个即将过期的访问令牌。
我不想在我的项目中使用 Guardian_db。那么,我如何在登录端点中生成访问令牌和刷新令牌?
我的代码是:
文件 mix.ex
# Authentication library
{:guardian, "~> 1.0"}
文件 config.exs
# Guardian configuration
config :my_proj, MyProj.Guardian,
issuer: "my_proj",
verify_module: Guardian.JWT,
secret_key: "Xxxxxxxxxxxxxxxxxxxxxxxxxx",
allowed_drift: 2000,
verify_issuer: true,
ttl: {5, :minutes}
# Ueberauth configuration
config :ueberauth, Ueberauth,
base_path: "/api/auth",
providers: [
identity: {
Ueberauth.Strategy.Identity,
[
callback_methods: ["POST"],
callback_path: "/api/auth/login",
nickname_field: :email,
param_nesting: "account",
uid_field: :email
]
}
]
文件 aut_access_pipeline.ex
defmodule MyProjWeb.Plug.AuthAccessPipeline do
use Guardian.Plug.Pipeline, otp_app: :my_proj
plug(Guardian.Plug.VerifySession, claims: %{"typ" => "access"})
plug(Guardian.Plug.VerifyHeader, claims: %{"typ" => "access"})
plug(Guardian.Plug.EnsureAuthenticated)
plug(Guardian.Plug.LoadResource, ensure: true)
plug(MyProjWeb.Plug.CurrentUser)
plug(MyProjWeb.Plug.CheckToken)
end
文件 auth_controller.ex
defmodule MyProjWeb.AuthenticationController do
def login(conn, %{"email" => email, "password" => password}) do
case Accounts.get_user_by_email_and_password(email, password) do
{:ok, user} ->
handle_login_response(conn, user, "login.json")
{:error, _reason} ->
conn
|> put_status(:unauthorized)
|> Error.render(:invalid_credentials)
|> halt
end
end
def refresh(conn, %{"jwt" => existing_jwt}) do
case MyProj.Guardian.refresh(existing_jwt, ttl: {5, :minutes}) do
{:ok, {_old_token, _old_claims}, {new_jwt, _new_claims}} ->
current_user = current_resource(conn)
user = MyProj.Accounts.get_user!(current_user.id)
conn
|> put_resp_header("authorization", "Bearer #{new_jwt}")
|> render(MyProjWeb.AuthenticationView, json_file, %{jwt: new_jwt, user: user})
{:error, _reason} ->
conn
|> put_status(:unauthorized)
|> Error.render(:invalid_credentials)
end
end
defp handle_login_response(conn, user, json_file) do
new_conn = MyProj.Guardian.Plug.sign_in(conn, user, [])
jwt = MyProj.Guardian.Plug.current_token(new_conn)
%{"exp" => exp} = MyProj.Guardian.Plug.current_claims(new_conn)
new_conn
|> put_resp_header("authorization", "Bearer #{jwt}")
|> put_resp_header("x-expires", "#{exp}")
|> render(MyProjWeb.AuthenticationView, json_file, %{jwt: jwt, user: user})
end
end
end
文件监护人.ex
defmodule MyProj.Guardian do
use Guardian, otp_app: :my_proj
def subject_for_token(user = %User{}, _claims),
do: {:ok, "User:#{user.id}"}
def subject_for_token(_user, _claims) do
{:error, :no_resource_id}
end
def resource_from_claims(%{"sub" => "User:" <> id}) do
{:ok, MyProj.Accounts.get_user!(id)}
end
def resource_from_claims(_claims) do
{:error, :no_claims_sub}
end
end
使用此代码,我有一个有效的访问令牌,但我不知道如何生成刷新令牌以在他过期时重新生成/刷新访问令牌......
有人可以帮忙吗?