Node.js 使用 ExpressJs token 进行身份验证

Question

我正在尝试为我的服务器创建登录请求。我想学的是 如何在用户登录时创建 token 。创建 token 后，我想用该 token 控制用户的请求。这是我的代码示例。请告诉我哪里出错了。如果所有的方式都是真的，你能向我解释一下如何创建它吗？

    var port = 8080;
var express = require("express");
var bodyParser = require('body-parser');
var mysql = require('mysql');
var bcrypt = require('bcrypt');
var session = require('express-session');

var con = mysql.createConnection({
    host: "localhost",
    user: "root",
    password: "123456789",
    database: "circles",
    debug: false
});

process.on('uncaughtException', function (err) {
    console.log('UNCAUGHT', err.stack);
});

var app = express();
app.use(express.static("localhost" + "/public")); //use static files in ROOT/public folder
app.use(bodyParser.json()); // support json encoded bodies
app.use(bodyParser.urlencoded({ extended: true }));
app.use(session({secret: 'letsputasmile',
                proxy: true,
                resave: true,
                cookie: { maxAge : 2628000000 },
                saveUninitialized: true
                }));

app.get("/", function(request, response){ //root dir
    response.send("Hello!!");
    console.log(response);
});



app.post("/register", function (request, response) {
    var name = request.body.name;
    var username = request.body.username;
    var pass = request.body.pass;
    var salt = bcrypt.genSaltSync(10);
    var hash = bcrypt.hashSync(pass,salt);
    console.log(name);
    console.log(username);
    console.log(pass);
    con.query("Insert Into user(name,username,password) Values(\"" + name + "\"," + "\"" + username + "\"," + "\"" + hash + "\")",
        function (err,result) {
        if(err) response.send("nop");
        else response.send("success");
        });
});

app.post("/login", function(request, response) {
    var username = request.body.username;
    var pass = request.body.pass;
    var passer;

    con.query("select password from user where username = " + "\"" + username + "\"",function (err, result) {
        if(err) throw err;
        if(result.length === 1) {
            passer = result[0].password;
        }
        bcrypt.compare(pass, passer, function (err, res) {
            if(res) response.send("success");
            else response.send("nop");
        });
    });
});

app.listen(port);

Answer 1

您可以做的是创建一个jwt(json webtoken)。您基本上签署了一些有效负载(无论您想要提供给客户端的任何元数据)，然后客户端可以在请求某些内容时将 token 传回，服务器可以验证 token (对称 key )是否正确，并解析服务器的数据需求，例如user_id 或类似内容。

检查https://github.com/auth0/node-jsonwebtoken了解更多信息