nodejs - JSONWebToken 过期问题

Question

我正在尝试使用 Json Web 令牌（借助此 article ）对我的 nodejs api 进行身份验证，但问题是令牌永远不会过期。

var express = require('express');
var app = express();
var mongoose = require('mongoose');
var bodyParser = require('body-parser');
var jwt = require('jsonwebtoken');




mongoose.connect('mongodb://localhost/gd');
var schema = mongoose.Schema;

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

var router = express.Router();

app.use('/api', router);

var userSchema = new schema({
   username: String,
   password: String
},{
    collection: 'users'
});

var User = mongoose.model('User', userSchema);



router.post('/authenticate', function(req, res) {

  User.findOne({
    username: req.body.username
  }, function(err, user) {

    if (err) throw err;

    if (!user) {
      res.json({ success: false, message: 'Authentication failed. User not found.' });
    } else if (user) {

      if (user.password != req.body.password) {
        res.json({ success: false, message: 'Authentication failed. Wrong password.' });
      } else {

        var token = jwt.sign(user, "secret", {
          expiresIn: 60
        });

        res.json({
          success: true,
          message: 'Enjoy your token!',
          token: token
        });
      }   

    }

  });
});



router.use(function(req, res, next) {

  var token = req.body.token || req.query.token || req.headers['x-access-token'];

  if (token) {

    jwt.verify(token, "secret", function(err, decoded) {      
      if (err) {
        return res.json({ success: false, message: 'Failed to authenticate token.' });    
      } else {
        req.decoded = decoded;    
        next();
      }
    });

  } else {

    return res.status(403).send({ 
        success: false, 
        message: 'No token provided.' 
    });

  }
});

router.get('/users', function(req, res) {
  User.find({}, function(err, users) {
    res.json(users);
  });
});  

var server = app.listen(3001, function () {
  var host = server.address().address;
  var port = server.address().port;

});

Answer 1

为了知道令牌的过期时间，jwt 向 payload 添加了一个 exp 属性。但是，当您将其传递给 jwt.sign 时，您的有效载荷是一个猫鼬对象，它将（静默地）不允许您添加未在架构中定义的属性。

解决方案应该是在将用户作为有效负载传递之前将其转换为普通对象：

var token = jwt.sign(user.toObject(), "secret", {
  expiresIn: 60
});

Answer 2

下面的代码片段对我有用..

var 令牌 = jwt.encode({ 问题：'user'，过期时间：60 }, 'secretToken');

Answer 3

同意@ploutch 的观点，效果很好！

var token = jwt.sign(user.toObject(), "secret", {
  expiresIn: 60
});

nodejs - JSONWebToken 过期问题

nodejs - JSONWebToken expiration issue

node.js

express

json-web-token