tPWzS3jD

1'use strict';
2const express = require('express');
3const jwt = require('jsonwebtoken');
4
5const app = express();
6const PORT = 4000;
7// 可以fs.readfile...
8const SECRET_KEY = 'secretkey123';
9// 配置，expires：过期时间。
10const jwtConfig = {expiresIn: '18s'};
11
12app.get('/api', (req, res, next) => {
13  res.json({
14    message: 'Welcome to the API.',
15  });
16});
17
18app.post('/api/posts', verifyToken, (req, res) => {
19  jwt.verify(req.token, SECRET_KEY, (err, authData) => {
20    if (err) {
21      /* 如果token过期，err格式
22      * err = {
23          name: 'TokenExpiredError',
24          message: 'jwt expired',
25          expiredAt: '2018-01-01T13:23:25.000Z'
26        }
27        如果token验证错误，err格式
28        err = {
29          name: 'JsonWebTokenError',
30          message: 'invalid token'
31        }
32      * */
33      res.json({err});
34      res.sendStatus(403);
35    } else {
36      res.json({
37        message: 'Post created...',
38        authData,
39      });
40    }
41  });
42});
43
44app.post('/api/login', (req, res) => {
45  // Mock user
46  const user = {
47    id: 1,
48    username: '小明',
49    email: 'hello@qq.com',
50  };
51  // 获取token;
52  jwt.sign({user}, SECRET_KEY, jwtConfig, (err, token) => {
53    res.json({token});
54  });
55});
56
57// token格式
58// Authorization: Bearer <access_token>
59
60// 检验是否有Token
61function verifyToken(req, res, next) {
62  // 获取authorization 的值
63  const bearerHeader = req.headers['authorization'];
64  // 检查如果bearer是否存在
65  if (typeof bearerHeader !== 'undefined') {
66    // 得到token
67    const token = bearerHeader.substr(8);
68    // 设置token
69    req.token = token;
70    // Next middleware
71    next();
72  } else {
73    // Forbidden //被禁止
74    res.sendStatus(403);
75  }
76}
77
78app.listen(PORT, function() {
79  console.log(`Server started on the port ${PORT}`);
80});