適用於NodeJS和Auth0的JWT Auth

Question

我正在使用Auth0在正在開發的MEAN應用上進行用戶身份驗證。 我遇到的問題是我已將模型，路由和控制器分離到單獨的文件中。 我正在按照Auth0教程來指導在何處使用JWT令牌認證，但是我不確定它在我的設置中應屬於什么位置。

checkJwt在哪里？

https://auth0.com/docs/quickstart/backend/nodejs/01-authorization

健身路由器

module.exports = function(app) {
    var workouts = require('../controllers/workoutController');

    // workout Routes
    app.route('/api/workouts')
      .get(workouts.getAllWorkouts)
      .post(workouts.createWorkout);

    app.route('/api/workouts/benchmarks')
    .get(workouts.getBenchmarks);

    app.route('/api/workouts/:workoutId')
      .get(workouts.getWorkout)
      .put(workouts.updateWorkout)
      .delete(workouts.deleteWorkout);
  };

對應控制器

var mongoose = require('mongoose'),
  Workout = mongoose.model('Workout');

exports.getAllWorkouts = function(req, res) {
  Workout.find({}, function(err, workouts) {
    if (err)
      res.send(err);
    res.json(workouts);
  });
};


exports.getBenchmarks = function(req, res) {
  Workout.find({
    "type":"Benchmark"
  }, function(err, workouts) {
    if (err)
      res.send(err);
    res.json(workouts);
  });
};

exports.createWorkout = function(req, res) {
  var newWorkout = new Workout(req.body);
  newWorkout.save(function(err, workout) {
    if (err)
      res.send(err);
        res.json(workout);
  });
};

exports.getWorkout = function(req, res) {
  Workout.findById(req.params.workoutId, function(err, workout) {
    if (err)
      res.send(err);
    res.json(workout);
  });
};


exports.updateWorkout = function(req, res) {
  Workout.findOneAndUpdate({_id: req.params.workoutId}, req.body, {new: true}, function(err, workout) {
    if (err)
      res.send(err);
    res.json(workout); 
  });
};

exports.deleteWorkout = function(req, res) {
  Workout.remove({
    _id: req.params.workoutId
  }, function(err, workout) {
    if (err)
      res.send(err);
    res.json({ message: 'Workout successfully deleted' });
  });
};

鍛煉帖子（）

exports.createWorkout = function(req, res) {
  var newWorkout = new Workout(req.body);
  newWorkout.save(function(err, workout) {
    if (err)
      res.send(err);
        res.json(workout);
  });
};

Answer 1

首先，您應該在單獨的文件中配置checkJwt （如在docs中 ），並在路由器文件中要求它。

讓我們看看如何保護您的鍛煉路由器中的路由：

module.exports = function(app) {
    var workouts = require('../controllers/workoutController');
    var checkJwt = require('./path/to/checkJwt');

    // workout Routes
    app.route('/api/workouts')
      .get(workouts.getAllWorkouts) // unprotected route
      .post(checkJwt, workouts.createWorkout); // protected route

    app.route('/api/workouts/benchmarks')
    .get(workouts.getBenchmarks);

    app.route('/api/workouts/:workoutId')
      .get(workouts.getWorkout)
      .put(workouts.updateWorkout)
      .delete(workouts.deleteWorkout);
};

函數checkJwt是一個中間件，可以在到達控制器邏輯之前檢查請求是否已通過身份驗證。

checkJwt文件：

var checkJwt = jwt({
  ...
})

module.exports = checkJwt