java - 从 android 发送时 token 显示已过期

Question

当我从 postman 发送 token (承载)时，它工作正常。但是，当我从 Android 应用程序发送相同的 token 时，它显示 token 已过期，但它是否新鲜且未过期，并且 token 与 postman 正常工作。

我尝试发送一个没有 token 的获取请求，它工作正常。服务器运行良好，类除身份验证外工作正常。

用于检查 token 的 Node js 代码:

const jwt = require('jsonwebtoken');
const JWT_KEY = require('../../config').getJwtSecrete();

module.exports = async (req, res, next) => {

try {
    let token = req.headers.authorization;
    token = getTokenFromHeader(token);
    const decoded = jwt.verify(token, JWT_KEY);
    req.email = decoded.email;
    next();
} catch (error) {
    return res.status(401).json({
        message: 'Auth failed'
    });
}
};

function getTokenFromHeader(token) {
return token.split(" ")[1];
}

Android:我发送请求的获取请求方法

public class GET_Request extends AsyncTask<String, Void, Bundle> {

private static final String REQUEST_METHOD = "GET";
private static final int READ_TIMEOUT = 10000;
private static final int CONNECTION_TIMEOUT = 10000;
private GETAsyncResponse delegate;

public GET_Request(GETAsyncResponse delegate) {
    this.delegate = delegate;
}

@Override
protected Bundle doInBackground(String... params) {

    String Url = params[0];
    Bundle bundle = new Bundle();
    String result = null;
    BufferedInputStream bufferedInputStream;
    ByteArrayOutputStream byteArrayOutputStream;

    try {
        URL requestUrl = new URL(Url);
        HttpURLConnection connection = (HttpURLConnection) requestUrl.openConnection();
        connection.setRequestMethod(REQUEST_METHOD);
        connection.setReadTimeout(READ_TIMEOUT);
        connection.setConnectTimeout(CONNECTION_TIMEOUT);
        connection.setDoInput(true);
        connection.setUseCaches(false);
        connection.setRequestProperty("Content-Type", "application/json; charset=UTF-8");
        connection.setRequestProperty("Accept", "application/json");
        connection.setRequestProperty("Authorization", "Bearer " + UserInfo.getToken());
        connection.connect();

        if (connection.getResponseCode() == HTTP_OK) {

            bufferedInputStream = new BufferedInputStream(connection.getInputStream());
            int bisReadResult = bufferedInputStream.read();
            byteArrayOutputStream = new ByteArrayOutputStream();

            while (bisReadResult != -1) {
                byteArrayOutputStream.write((byte) bisReadResult);
                bisReadResult = bufferedInputStream.read();
            }
            result = byteArrayOutputStream.toString();
        } else { //reading error
            Log.e("doInBackground: ", String.valueOf(connection.getResponseCode()));

            String error;
            bufferedInputStream = new BufferedInputStream(connection.getInputStream());
            int bisRealError = bufferedInputStream.read();
            byteArrayOutputStream = new ByteArrayOutputStream();

            while (bisRealError != -1) {
                byteArrayOutputStream.write((byte) bisRealError);
                bisRealError = bufferedInputStream.read();
            }
            /*This error string is for debugging*/
            error = byteArrayOutputStream.toString();
            Log.e("Error Buffer: ", error);
        }
        bundle.putString(JSON, result);
        bundle.putInt(RESPONSE_CODE, connection.getResponseCode());
        connection.disconnect();
    } catch (FileNotFoundException f) {
        f.printStackTrace();
        bundle.putInt(RESPONSE_CODE, 400);
    }
    /*Internet not connected*/ catch (SocketTimeoutException s) {
        bundle.putInt(RESPONSE_CODE, 0);
    }
    /*Any other error*/ catch (IOException e) {
        e.printStackTrace();
        bundle.putInt(RESPONSE_CODE, 500);
    }
    return bundle;
}

protected void onPostExecute(Bundle result) {
    super.onPostExecute(result);
    delegate.AfterGetRequestFinish(result);
}

public interface GETAsyncResponse {
    void AfterGetRequestFinish(Bundle bundle);
}
}

我希望它能够成功验证。但我不知道为什么它失败并显示代码“401”和“java.io.FileNotFoundException”。

Answer 1

JWT 的特点之一是它们本质上是防篡改的。也就是说，假设您的可疑 JWT 在 Node JS 服务器端具有有效的签名和校验和，那么这意味着您的 Android Java 代码不可能更改该 token 的到期日期。

话虽如此，这里最可能的解释是您传递的 token 实际上已经过期。发生这种情况的原因有很多，很可能是您在某个地方缓存了旧 token ，也许是在共享首选项中。