NodeJS使用JWT跨域身份验证方案详解

var jwt = require('jsonwebtoken');

const secret = 'nidemiyao'//用于加密

	//生成token
//info也就是payload是需要存入token的信息
	function createToken(info) {
	    let token = jwt.sign(info, secret, {
	        //Token有效时间 单位s
	        expiresIn:60 * 60*24
	    })
	return token
}

//验证Token
function verifyToken(token) {
    console.log(token)
    return new Promise((resolve, reject) => {
      jwt.verify(token, secret, (error, result) => {
            if(error){
                reject(error)
            } else {
                resolve(result)
            }
      })
    })
}

//白名单
const whiteList = ['/manage/login']

路由名.use((req,res,next) => {
    if(!whiteList.includes(req.url)) {
    	//判断请求头是否携带正确的token
        verifyToken(req.headers.authorization).then(res => {
            next()
        }).catch(e => {
            res.status(401).send('403')//验证失败返回什么
        })
    } else {
        next()
    }
})

//登陆
路由名.post("/manage/login",(req,res)=>{
    let {user}=req.body;
        let sql=`select *from admin where uname='${user.username}' and upassword='${user.password}'`;
        conn.query(sql,(err,result,fields)=>{
            if(err){
                return "失败";
            }
            console.log(result)
            if(result.length!==0){
                let token =createToken(user)
                res.send({"result":result,"token":token});
            }else{
                res.send({"result":result});
            }
        })
});