JWT 令牌未過期

Question

無論出於何種原因，由jsonwebtoken生成的令牌永遠不會過期。

到目前為止，這是我的代碼。

auth.ts中間件。

// Libs
import { Express, Request, Response, NextFunction } from "express";
import { PassportStatic } from "passport";
import { Strategy as JWTStrategy, ExtractJwt } from "passport-jwt";

// Users
import { usersDB } from "../users";

const setupAuth = (api: Express, passport: PassportStatic) => {

  const strategy = new JWTStrategy(
    {
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey: "123456qwerty",
      algorithms: ["HS256"],
    },
    (payload, cb) => {
      try {
        const { sub } = payload;

        const user = usersDB.find((u) => u.username === sub);

        if (user) {
          return cb(null, user);
        } else {
          return cb(null, false);
        }
      } catch (e) {
        return cb(e);
      }
    }
  );

  api.use(passport.initialize());

  passport.use(strategy);
};

export default setupAuth;

登錄路徑

import { Request, Response } from "express";

import { usersDB, validatePassword } from "../../users";

import { genJWT } from "../../utils/auth";

const login = (req: Request, res: Response) => {
  const { username, password } = req.body;

  const user = usersDB.find((u) => u.username === username);

  if (!user) {
    return res
      .status(401)
      .json({ status: "fail", message: "Invalid username or password" });
  }

  if (!validatePassword(password, user.salt, user.hash)) {
    return res
      .status(401)
      .json({ status: "fail", message: "Invalid username or password" });
  }

  const token = genJWT(user.username);

  res.status(200).json({ status: "success", token });
};

export default login;

和 jwt 令牌生成器

import jwt from "jsonwebtoken";

export const genJWT = (username: string) => {
  const token = jwt.sign({ sub: username, iat: Date.now() }, "123456qwerty", {
    expiresIn: "1min",
    algorithm: "HS256",
  });

  return token;
};

然后是安全路線

// Lib
import { Express } from "express";
import { PassportStatic } from "passport";

// GET
import root from "./GET/root";
import currentUser from "./GET/current-user";
import privateContent from "./GET/private-content";

// POST
import register from "./POST/register";
import login from "./POST/login";
import logout from "./POST/logout";

const setupRoutes = (api: Express, passport: PassportStatic) => {
  api.get("/", root);
  api.get(
    "/current-user",
    passport.authenticate("jwt", { session: false }),
    currentUser
  );
  api.get(
    "/private-content",
    passport.authenticate("jwt", { session: false }),
    privateContent
  );

  api.post("/register", register);
  api.post("/login", login);
  api.post("/logout", logout);
};

export default setupRoutes;

所以 API 正在工作，能夠生成 jwt 令牌，能夠使用令牌進行身份驗證。 如果我修改令牌，它也可以驗證。 但問題是我可以永遠使用令牌。 它永不過期。

有什么我錯過的嗎？

提前致謝。

Answer 1

好的，當我刪除

iat: Date.now()

來自jwt.sign ，現在令牌確實過期了。 所以永遠不要放iat ，讓jsonwebtoken生成它。