我是否需要将有效负载传递给此代码以生成 JWT 令牌？

Question

I want to use JWT to generation token to authenticate users. When I use postman to test the code with a registered username and password, it returned the JsonWebTokenError: jwt malform . On close review, I discovered that the error comes from jwt.verify section.

1. Do I need to pass a payload value to generate the token?
2. How can I configure it so that when a users makers a log in request, say he's passing his username and password, along with email and password, the client must pass a client identity ( [payload + clientID] ), for the server to know for whom the token is to be signed.
3. Is there any special value I need to pass in Postman Header to test the working of the token system?

THE CODE

const jwt = require('jsonwebtoken');
const fs = require('fs');

// PRIVATE and PUBLIC key
const publicKey = fs.readFileSync(__dirname + '/public.key', 'utf8');
const privateKey = fs.readFileSync(__dirname + '/private.key', 'utf8');

// Returns secret only known to server at runtime
exports.getSecret = () => {
  const secret = require('../config/secret.json').secret;
  return secret;
};

// Returns token
exports.getToken = (payload, signOptions) => {
  if (!signOptions) {
    signOptions = {
      issuer:  "Myself",
      expiresIn:  "30d", 
      algorithm:  "RS256"
    }    
  };
   const token = jwt.sign(payload, privateKey, options);
  return (token);
};

// Returns result of token validation
exports.validateToken = (token, verifyOptions) => {

  if (!verifyOptions) {
    verifyOptions = {
      issuer:  "Myself",
      expiresIn:  "30d", 
      algorithm:  "RS256"
    }    
  };
  try {
    return jwt.verify(token, publicKey, verifyOptions);
  } catch (err) {
    return err;
  }
};

// Returns validation result of token
exports.token_post = (req, res) => {
  res.send(this.validateToken(req.header.Authorization, this.getSecret()));
};

The remaining part of the code below is linked to a permission file that is used to validate users. The error shows that the argument is not getting to the this.validateToken part.

exports.hasPermission = (token, resource) => {
  const result = this.validateToken(token, this.getSecret());
  console.log(result);
  if (result.name === 'JsonWebTokenError') {
    return false;
  } else if (result.permissions) {
    let permissionSet = new Set(result.permissions);
    console.log('permissions in token', JSON.stringify(permissionSet));
    return permissionSet.has(resource);
  } else {
    return false;
  }
};

I EDITED JWT.(SIGN) FUNCTION AS FOLLOWS

return jwt.sign(payload, privateKey, signOptions, function (error, token){
    if(error) {
      return done(new JsonWebTokenError('error in generating token: ' + error.message));
    } else {
      console.log("Token :" + token);
    }
  });
};

Answer 1

jwt.sign() return a callback function like this

jwt.sign(payload, expiration, function (error, token) {
    if(error) {
        // Faild Error 
    } else {
        // Get token and do continue
    }
});