更新为passport-jwt并得到未经授权的错误

Question

I've upgraded from passport-jwt 1.2.1 to pasport-jwt 4.0. I updated the passport code to use the ExtractJwt.fromHeader, which I believe is labeled 'Authorizaton', which you will see in my Header Request code below.

var JwtStrategy = require('passport-jwt').Strategy,
    ExtractJwt = require('passport-jwt').ExtractJwt;

// load up the user model
var User = require('../models/user');
var config = require('../config/database'); // get db config file


module.exports = function(passport) {
  var opts = {}
  opts.jwtFromRequest = ExtractJwt.fromHeader('Authorization');
  opts.secretOrKey = 'secret';

  passport.use(new JwtStrategy(opts, function(jwt_payload, done) {
      User.findOne({id: jwt_payload.sub}, function(err, user) {
          if (err) {
              return done(err, false);
          }
          if (user) {
              return done(null, user);
          } else {
              return done(null, false);
          }
      });
  }));
};

My header request shows like below, which just has some test code in it.

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Authorization: JWT eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJfaWQiOiI1YWQyNTc3MWQwZWM3YzQ2YmFhNjYzOTgiLCJsb2dpbiI6ImNuYWtlYSIsInBhc3N3b3JkIjoiJDJhJDEwJFAzVG1wNDU3ZmhHdHdnaTZseGRRSGVRUENmR1F0OWMvWHVtSDZCTEtUlVQbUEvLnZvRGp5IiwiZW1haWwiOiJjaHJpc0BjaHJpc25ha2VhLmNvbSIsImNvbmZpcm1hdGlvbljb2RlIjoiMjk3NTNiZDYtZTQyYi1kYjRkLWM4ODUtZDE5MzlmYjdkZWU4IiwiY29uZmlybV9leHBpcmUiOiyMDE4LTA0LTE1VDE5OjMzOjA1LjQ0OVoiLCJfX3YiOjAsImNvbmZpcm1lZCI6dHJ1ZX0.ow_5ZsqEeP_2oJxG7IuzZUJrsZa84CDMW3Nk4qXbgik
Cache-Control: no-cache
Connection: keep-alive
Host: localhost:3000
Origin: http://localhost:8100
Pragma: no-cache
Referer: http://localhost:8100/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1

For some reason I'm getting a response of "Unauthorized".

This is how I'm placing the call from my angularjs service:

  function useCredentials(token) {
    isAuthenticated = true;
    authToken = token;

    // Set the token as header for your requests!
    $http.defaults.headers.common.Authorization = authToken;
  }

How do I fix this?

So it looks like the Authentication code is working, and it is actually this code that is failing:

var express = require('express');
var router = express.Router();
var jwt = require('jwt-simple');
var config = require('../config/database'); 
var passport  = require('passport');

require('../config/passport')(passport);

var User = require('../models/user');

router.route('/')

.get(passport.authenticate('jwt', { session: false}), function(req, res) {

  var token = getToken(req.headers);

  if (token) {

    var decoded = jwt.decode(token, config.secret);

    User.findOne({
      login: decoded.login
    }, function(err, user) {
        if (err) throw err;

        if (!user) {
          return res.status(403).send({success: false, msg: 'Authentication failed. User not found.'});
        } else {

          //CUSTOMIZE DATA TO RETURN ***
          var data = {
            id:user.id,
            login:user.login,
            email:user.email
          };

          res.json(data);
        }
    });

  } else {
    return res.status(403).send({success: false, msg: 'No token provided.'});
  }
});

getToken = function (headers) {
  if (headers && headers.authorization) {
    var parted = headers.authorization.split(' ');
    if (parted.length === 2) {
      return parted[1];
    } else {
      return null;
    }
  } else {
    return null;
  }
};

module.exports = router;

Answer 1

Try this:

opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();

This will create a new extractor that looks for the JWT in the authorization header with the scheme 'bearer' so your header will be something like this Authorization: Bearer jk12h3j231231jkl12j

function useCredentials(token) {
    isAuthenticated = true;
    authToken = token;

    // Set the token as header for your requests!
    $http.defaults.headers.common.Authorization = `Bearer ${authToken}`;
}