如何使用 express 在标头中发送 JWT 令牌？

Question

I cannot redirect the page with headers. I alreade used.set() and.setHeader(), but both doesn't put the token, or nother element, in header. I also tried to use 'res.redirect('index', {token}), but is not work.

login.js

require('dotenv').config();
const jwt = require('jsonwebtoken');
const User = require('../model/User')
const bycrypt = require('bcryptjs');

module.exports={
    async login(req, res){ 
        const { email, password } = req.body

        const userId = await User.findUserId(email)
        if(userId == '') res.status(400).send(new Error('Email invalid!'))

        const passHash = await User.passHash(userId[0].id)
        if(passHash == '')res.status(400).send(new Error('Password invalid!'))

        const passCompare = await bycrypt.compare(password, passHash[0].password)

        if(passCompare == true){
            const id = userId[0].id
            const token = jwt.sign({ id }, process.env.SECRET, {
                expiresIn: 3600
            })   >>>>>>>>this token

            return res.status(200).redirect('/index')
        }
        res.status(500).json({ message: 'Login Inválido!' })
    }
}

authenticate middleware

require('dotenv').config();
const jwt = require('jsonwebtoken');

module.exports={
    verifyJWT(req, res, next){
        const token = req.headers['x-access-token'];
        
        if(!token) {
            return res.status(400).render('login')
        }
        jwt.verify(token, process.env.SECRET, (err, decoded) =>{
            if(err){
                console.log(err)
                return res.status(300).render('login')
            }
            req.userId = decoded.id
            next()
        })
    }
}

server.js This is the root page. I don't know if the problem is in the part of code.

const express = require('express');
const http = require('http');
const path = require('path');
const routes = require('./routes/index');
const server = express()
const bodyParser = require('body-parser')

server.set('view engine', 'ejs')
server.set('views', path.join(__dirname, 'views'))

server.use(bodyParser.json())

server.use(express.static('public'))
server.use(express.json())
server.use(express.urlencoded({ extended: true }))
server.use('/files', express.static(path.resolve(__dirname, '..' , '..', 'tmp', 'files' )))
server.use(routes)

http.createServer(server).listen(process.env.PORT || 3000, () => {
    console.log('Rodando')
})

Answer 1

You can set headers on the redirect response back to the client. But if the client is a browser that is following the redirect automatically, the browser will not take the headers from your response and magically attach them to the redirected request. Those headers will just be dropped.

There are a couple ways to pass data to a redirected response via automatic redirection.

1. You can put info in a queryString in the redirect URL and have your server look for it there when the redirect request comes back to your server.

2. You can set a cookie on the response and then that cookie will come back to your server on the redirected request.

For a JWT token, the cookie is perhaps a better way to do things.

---

If the client for this request is your own Javascript code and it's your own Javascript that is processing and following the redirect, then your own client Javascript code can grab the custom x-access-token header and put it on the redirected request.