令牌(用于测试)我使其持续时间只有60秒，但它似乎永远不会过期.将它传递给Postman上的承载者，getInfo路由继续给我一个响应，就好像令牌在60秒后仍然有效.我能做错什么？
我有这个文件夹树:
├── app.js
├── node_modules
├── package-lock.json
├── package.json
├── private
│ ├── private.key
│ └── public.key
├── public
│ ├── html
│ │ └── cover.html
│ └── images
│ ├── logo-w.png
│ └── logo.png
├── request.http
├── src
│ ├── auth
│ │ ├── authService.js
│ │ └── tokenManager.js
│ ├── middleware
│ │ └── authMiddleware.js
│ └── routes
│ ├── Auth.js
│ └── info.js
我有不同的文件，但主文件是app.js
const express = require("express");
const path = require("path");
const port = process.env.PORT || 3000;
const app = express();
const fs = require('fs');
const jwt = require('jsonwebtoken');
require('dotenv').config();
app.use(express.static("public"));
app.use(express.json());
app.get("/", (req, res) => {
res.sendFile(path.join(__dirname, "public/html", "cover.html"));
});
const infoRoute = require("./src/routes/info");
const authRoute = require("./src/routes/auth");
app.use("/info", infoRoute);
app.use("/auth", authRoute);
app.listen(port, () => {
console.log("Server Is Running On Port", port);
});
在我的authService.js中，我模拟了一个用于测试的简单登录:
const { issueJWT, issueRefreshToken } = require('./tokenManager');
const users = [{ id: 1, username: 'test', password: 'password' }];
const login = (username, password) => {
const user = users.find(u => u.username === username && u.password === password);
if (!user) throw new Error('Credentials not valid');
const tokenObject = issueJWT(user);
const refreshToken = issueRefreshToken(user);
return {
...tokenObject,
refreshToken: refreshToken
};
};
module.exports = { login };
在我的tokenManager.js中
const jwt = require('jsonwebtoken');
const fs = require('fs');
const path = require('path');
const PRIV_KEY = fs.readFileSync(path.join(__dirname, '../../private/private.key'), 'utf8');
const issueJWT = (user) => {
const expiresIn = 60;
const payload = {
sub: user.id,
iat: Date.now(),
};
const signedToken = jwt.sign(payload, PRIV_KEY, { expiresIn: expiresIn, algorithm: 'RS256' });
return {
token: "Bearer " + signedToken,
expires: expiresIn
};
};
const issueRefreshToken = (user) => {
const expiresIn = '7d';
const payload = {
sub: user.id,
iat: Date.now(),
};
const refreshToken = jwt.sign(payload, PRIV_KEY, { expiresIn: expiresIn, algorithm: 'RS256' });
return refreshToken;
};
module.exports = { issueJWT, issueRefreshToken };
在我的authMiddleware.js中
const jwt = require('jsonwebtoken');
const fs = require('fs');
const path = require('path');
const PUB_KEY = fs.readFileSync(path.join(__dirname, '../../private/public.key'), 'utf8');
const authenticateJWT = (req, res, next) => {
const authHeader = req.headers.authorization;
if (authHeader) {
const token = authHeader.split(' ')[1];
jwt.verify(token, PUB_KEY, { algorithms: ['RS256'] }, (err, user) => {
if (err) return res.sendStatus(403);
req.user = user;
next();
});
} else {
res.sendStatus(401);
}
};
module.exports = { authenticateJWT };
Auth.js
const express = require('express');
const router = express.Router();
const { login } = require('../auth/authService');
const jwt = require('jsonwebtoken');
const { issueJWT } = require('../auth/tokenManager');
const fs = require('fs');
const path = require('path');
const PUB_KEY = fs.readFileSync(path.join(__dirname, '../../private/public.key'), 'utf8');
// Endpoint per il login
router.post('/login', (req, res) => {
const { username, password } = req.body;
try {
const { token, expires, refreshToken } = login(username, password); // Aggiunto refreshToken
res.json({
success: true,
token: token,
expiresIn: expires,
refreshToken: refreshToken // Inviato il refreshToken nella risposta
});
} catch (error) {
res.status(401).json({ success: false, message: error.message });
}
});
// Endpoint per il rinnovo del token
router.post('/refreshToken', (req, res) => {
const { refreshToken } = req.body;
if (!refreshToken) {
return res.status(401).json({ message: "Refresh Token richiesto" });
}
try {
const payload = jwt.verify(refreshToken, PUB_KEY, { algorithms: ['RS256'] });
// Aggiungi qui la logica per verificare che il refresh token sia ancora valido, per esempio controllando nel tuo database
const user = { id: payload.sub }; // Assumi che tu possa ottenere l'utente in base al sub nel payload
const newTokenObject = issueJWT(user);
res.json({
success: true,
token: newTokenObject.token,
expiresIn: newTokenObject.expires
});
} catch (error) {
return res.status(403).json({ message: "Refresh Token non valido" });
}
});
module.exports = router;
最后在我的info.js(保护区)
const express = require('express');
const router = express.Router();
const { authenticateJWT } = require('../middleware/authMiddleware');
router.get('/getInfo', authenticateJWT, (req, res) => {
res.json({ message: 'Protected area' });
});
module.exports = router;
