使用token实现权限管理和登录验证

一、 下载相关包

npm i jsonwebtoken -S
npm i passport-jwt passport -S

二、 导入包开始加密

let express = require('express');
let config = require('./config');

let router = express.Router();

// jwt
const jwt = require('jsonwebtoken');    //生成jwt字符串的包
const expressJWT = require('express-jwt');  //解析jwt字符串的包

router.post('/login', (req, res) => {
    const { username, password } = req.body;
    
    //登录成功
    //在登录成功之后 调用 jwt.sign() 方法生成JWT字符串 并通过 token 属性发送给客户端
    //参数1: 用户的信息对象
    //参数2: 加密的密钥
    //参数3: 配置对象 可以配置当前 token 的有效期
    const tokenStr = jwt.sign({ username }, config.SECRET, { expiresIn: '60s' }); //生成token
    if (username === 'username' && password === "password") {
        res.send({
            msg: '登录成功',
            token: 'Bearer ' + tokenStr	//生成token需要加前缀
        })
    }
})

module.exports = router;

返回结果

{
    msg:'登录成功',
    token:'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySUQiOiIwYmY2ODEwZC0xYTNmLTRkNzYtYTA3MC1hYzExNGNjZTRmODIiLCJ1c2VyTmFtZSI6InlhbmxpZmVpIiwiZW1haWwiOiJ1bmRlZmluZWQiLCJyaWdodHMiOiJhZG1pbmlzdGVyIiwiaWF0IjoxNjYxMzE1Mjc3LCJleHAiOjE2NjE0MDE2Nzd9.2cuMYivxM59JRRVKwUlGph-elLMfGWTZCT4UGfI8VJI'
}

三、 验证token

npm i passport-jwt passport -S

// ./passport.js
// passport-jwt完成passport验证函数
// jwt策略和提取jwt
const passportJwt = require('passport-jwt');
const config = require('./config');
const JwtStrategy = passportJwt.Strategy; //jwt策略
const ExtractJwt = passportJwt.ExtractJwt; //提取jwt
const opts = {
    jwtFromRequest : ExtractJwt.fromAuthHeaderAsBearerToken(),
    secretOrKey: config.SECRET
} //配置
module.exports = passport => {
    passport.use(new JwtStrategy(opts, (jwtPayload, done) => {
        // jwtPayload就是我们储存在token内部的用户信息对象解密的结果
        console.log(jwtPayload);    //{ username: 'username', iat: 1661057703, exp: 1661057763 }
        user = { username: jwtPayload.username };
        return done(null, user);
    }))
}

// app.js
// 引入并初始化passport
// 引入token验证库
const passport = require('passport');
// 初始化passport
app.use(passport.initialize());
// 调用验证token函数传入passport
require('./verifyToken')(passport)


// router.js
//使用passport验证函数给路由做接口验证
const passport = require('passport');
router.post('/getData', passport.authenticate('jwt', {session: false}), (req, res) => {
    //解密后的token携带参数会被放到req中
    res.status(200).send({
        msg: 'hello world',
        user: req.user.username
    });
})