JWT 登录鉴权全流程完整步骤

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJ1c2VyX2lkIjoxMjMsImV4cCI6MTcwMDAwMDAwMH0.
HMACSHA256(base64UrlEncode(header)+'.'+base64UrlEncode(payload), secret)

POST /login
Content-Type: application/json
{
  "username": "alice",
  "password": "123456"
}

# 伪代码（Python + Flask）
from werkzeug.security import check_password_hash
@app.route('/login', methods=['POST'])
def login():
    data = request.json
    user = User.query.filter_by(username=data['username']).first()
    if not user or not check_password_hash(user.password_hash, data['password']):
        return jsonify({"error": "用户名或密码错误"}), 401
    # 验证通过，生成 JWT
    token = generate_jwt(user_id=user.id)
    return jsonify({"token": token})

import jwt
import datetime
def generate_jwt(user_id):
    payload = {
        'user_id': user_id,
        'exp': datetime.datetime.utcnow() + datetime.timedelta(hours=2),  # 2小时过期
        'iat': datetime.datetime.utcnow()  # 签发时间
    }
    secret = 'your_strong_secret_key'  # 必须保密！建议从环境变量读取
    return jwt.encode(payload, secret, algorithm='HS256')

// 登录成功后
localStorage.setItem('token', response.data.token);
// 后续请求携带 Token
fetch('/profile', {
  headers: {
    'Authorization': 'Bearer ' + localStorage.getItem('token')
  }
})

GET /profile
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxxx

@app.route('/profile')
def profile():
    auth_header = request.headers.get('Authorization')
    if not auth_header or not auth_header.startswith('Bearer '):
        return jsonify({"error": "缺少 Token"}), 401
    token = auth_header.split(' ')[1]
    try:
        payload = jwt.decode(token, 'your_strong_secret_key', algorithms=['HS256'])
        user_id = payload['user_id']
        user = User.query.get(user_id)
        return jsonify({"username": user.username})
    except jwt.ExpiredSignatureError:
        return jsonify({"error": "Token 已过期"}), 401
    except jwt.InvalidTokenError:
        return jsonify({"error": "无效 Token"}), 401

# .env
JWT_SECRET=your_very_long_random_string_32_chars_or_more!

# 登出时将 jti 加入 Redis 黑名单（有效期 = token 剩余时间）
redis.setex(f"blacklist:{payload['jti']}", ttl, "1")
# 验证时检查黑名单
if redis.get(f"blacklist:{payload['jti']}"):
    raise Exception("Token 已失效")