瞄准镜通行证-jwt

Question

Can someone explain to me in detail why the route of /profile has access to the user object. I'm currently learning JavaScript and NodeJS your answer will be a big help in my learning Thank you guys.

app.post('/login',function (req, res) {
        let email = req.body.email;
        let password = req.body.password;
        User.getUserByEmail(email, (err, user) => {
            if (err) throw err;
            if (!user) {
                return res.json({
                    success: false,
                    message: "User not found!"
                });
            }
            User.comparePassword(password, user.password, (err, isMatch) => {
                if (err) throw err;
                if (isMatch) {
                    var token = jwt.sign(user.toJSON(), config.JWT_SECRET, {
                        expiresIn: '15m'
                    });
                    res.json({
                        success: true,
                        token: token,
                        user: {
                            id: user._id,
                            email: user.email
                        }
                    });
                } else {
                    return res.json({
                        success: false,
                        message: "Password incorrect!"
                    });
                }
            })
        });
    });

    app.get('/profile', passport.authenticate('jwt', {
        session: false
    }), (req, res) => {
        res.json({user: req.user});
    });

Answer 1

It is because your passport.authenticate() call populates user to req .

From passports.org:

app.post('/login',
  passport.authenticate('local'),
  function(req, res) {
    // If this function gets called, authentication was successful.
    // `req.user` contains the authenticated user.
    res.redirect('/users/' + req.user.username);
  });

It is the same for your route, except your path and authentication method is different.

See the documentation for more info: http://www.passportjs.org/docs/authenticate/

Answer 2

Some background

• The function app.get takes an url and one or many callbacks with (req, res, next) => {} as their signature
• The callbacks are executed one after the other. In anyone of these callbacks you can modify the req object and it will "propagate" to the next callbacks
• To switch from a callback to the next one, you call next

In your case

• The call to passport.authenticate('jwt', {sessions: false}) returns a callback , that's executed before you send the json response.
• That callback itself athenticates the user, then "inject" its value into the req object.
• As I mentioned before, this req will "propagate" to the next callback. And that's why when you send your json response, it req already contains the user key