使用Express验证JWT令牌。

huangapple
go评论94阅读模式
英文:

Validate a jwt token with express

问题

I've been getting a lot of errors saying

  1. POST http://localhost:4000/api/payment/create-checkout-session 403 (Forbidden)
  3. AxiosError {message: 'Request failed with status code 403', name: 'AxiosError', code: 'ERR_BAD_REQUEST', config: {...}, request: XMLHttpRequest, …}
  4. code
  5. : 
  6. "ERR_BAD_REQUEST"
  7. config
  8. : 
  9. "Request failed with status code 403"
  10. name
  11. : 
  12. "AxiosError"
  13. request 
  14. {data: 'A token is required', status: 403, statusText: 'Forbidden', headers: Axios

I think it has something to do with my token validation, this is the file for token validation

  1. const verifyToken = (req, res, next) => {
  2.     const token = req.body.token || req.query.token || req.headers['Authorization'];
  3.     console.log("Token: ", token);
  5.     if (!token) {
  6.       return res.status(403).send("A token is required");
  7.     }
  9.     try {
  10.       const decoded = jwt.verify(token, process.env.JWT_SECRET);
  11.       req.user = decoded;
  12.       next();
  13.     } catch (err) {
  14.       return res.status(401).send("Invalid token, this is the error message:" + err);
  15.     }
  16.   };
  17.   
  18.   module.exports = verifyToken;

This is the file that is making the axios post request

  1. const token = Cookies.get("token");
  2.   console.log("token from catalog " + token)
  4.   const checkout = () => {
  5.     axios({
  6.       method: "post",
  7.       url: "http://localhost:4000/api/payment/create-checkout-session",
  8.       headers: {
  9.         'Content-Type': 'application/json',
  10.         'Accept': 'application/json',
  11.         "Authorization": "Bearer " + token,
  12.       }
  13.     }).then(response => {
  14.       if (response.ok) return response.json();
  15.       return response.json().then(json => Promise.reject(json))
  16.     })
  17.     .then(({ url }) => {
  18.       window.location = url;
  19.     })
  20.     .catch(error => {
  21.       console.log(error)
  22.     })
  23.   }

This is the Express file that the axios is posting to

  1. require('./middleware')
  3. router.post("/create-checkout-session", async (req, res) => {
  5.   const { items } = req.body;
  7.   // Create a PaymentIntent with the order amount and currency
  8.   const paymentIntent = await stripe.paymentIntents.create({
  9.     amount: calculateOrderAmount(items),
  10.     currency: "usd",
  11.     automatic_payment_methods: {
  12.       enabled: true,
  13.     },
  14.   });
  16.   res.send({
  17.     clientSecret: paymentIntent.client_secret,
  18.   });
  20. })
  22. module.exports = router;

Is there a better way to validate a token, or am I missing a header or something in my axios request?

英文:

Ive been getting a lot of errors saying

  1. POST http://localhost:4000/api/payment/create-checkout-session 403 (Forbidden)
  3. AxiosError {message: 'Request failed with status code 403', name: 'AxiosError', code: 'ERR_BAD_REQUEST', config: {…}, request: XMLHttpRequest, …}
  4. code
  5. : 
  6. "ERR_BAD_REQUEST"
  7. config
  8. : 
  9. "Request failed with status code 403"
  10. name
  11. : 
  12. "AxiosError"
  13. request 
  14. {data: 'A token is required', status: 403, statusText: 'Forbidden', headers: Axios

I think it has something to do with my token validation, this is the file for token validation

  1. const verifyToken = (req, res, next) => {
  2.     const token = req.body.token || req.query.token || req.headers['Authorization'];
  3.     console.log("Token: ", token);
  4.   
  5.     if (!token) {
  6.       return res.status(403).send("A token is required");
  7.     }
  8.   
  9.     try {
  10.       const decoded = jwt.verify(token, process.env.JWT_SECRET);
  11.       req.user = decoded;
  12.       next();
  13.     } catch (err) {
  14.       return res.status(401).send("Invalid token, this is the error message:" + err);
  15.     }
  16.   };
  17.   
  18.   module.exports = verifyToken;

this is the file that is making the axios post request

  1. const token = Cookies.get("token");
  2.   console.log("token from catalog " + token)
  4.   const checkout = () => {
  5.     axios({
  6.       method: "post",
  7.       url: "http://localhost:4000/api/payment/create-checkout-session",
  8.       headers: {
  9.         'Content-Type': 'application/json',
  10.         'Accept': 'application/json',
  11.         "Authorization": "Bearer " + token,
  12.       }
  13.     }).then(response => {
  14.       if (response.ok) return response.json();
  15.       return response.json().then(json => Promise.reject(json))
  16.     })
  17.     .then(({ url }) => {
  18.       window.location = url;
  19.     })
  20.     .catch(error => {
  21.       console.log(error)
  22.     })
  23.   }

this is the express file that the axios is posting too

  1. require('./middleware')
  6. router.post("/create-checkout-session", async (req, res) => {
  8.   const { items } = req.body;
  10.   // Create a PaymentIntent with the order amount and currency
  11.   const paymentIntent = await stripe.paymentIntents.create({
  12.     amount: calculateOrderAmount(items),
  13.     currency: "usd",
  14.     automatic_payment_methods: {
  15.       enabled: true,
  16.     },
  17.   });
  19.   res.send({
  20.     clientSecret: paymentIntent.client_secret,
  21.   });
  23. })
  25. module.exports = router;

is there a better way to validate a toke, or am I missing a header or something in my axios request?

答案1

得分: 1

我认为你的验证是正确的，不需要深入研究你的代码。

你之所以得到403错误是因为没有Authorization头部信息。我假设你正在使用express。尽管你指定了头部是Authorization，但在express中要访问请求头部，你需要查找req.headers.authorization，其中a是小写。

我运行了一个简单的应用程序：

  1. import express from "express";
  3. const app = express();
  5. app.listen(3000, () => {
  6.   console.log("hi there 3000");
  7. });
  9. app.post("/auth", (req, res) => {
  10.   console.log(req.headers);
  11.   res.status(200).send(req.headers);
  12. });

然后使用curl进行了以下操作：➜ curl --header "Authorization: Bearer something" -I -X POST http://localhost:3000/auth

req.headers的输出如下：

  1. {
  2.   host: 'localhost:3000',
  3.   'user-agent': 'curl/7.79.1',
  4.   accept: '*/*',
  5.   authorization: 'Bearer something'
  6. }

如果有帮助，请告诉我。

英文:

Without digging too much into your code I think that your validation is fine.

You are getting the 403 because there is no Authorization header. I am going to assume that you are using express. Even though you specified that the header is Authorization with a capital A, in express to access that request header you have to look for req.headers.authorization with a lower-cased a.

I ran a simple app:

  1. import express from "express";
  3. const app = express();
  5. app.listen(3000, () => {
  6.   console.log("hi there 3000");
  7. });
  9. app.post("/auth", (req, res) => {
  10.   console.log(req.headers);
  11.   res.status(200).send(req.headers);
  12. });

Then curled the following: ➜ curl --header "Authorization: Bearer something" -I -X POST http://localhost:3000/auth

The req.headers is as follows:

  1. {
  2.   host: 'localhost:3000',
  3.   'user-agent': 'curl/7.79.1',
  4.   accept: '*/*',
  5.   authorization: 'Bearer something'
  6. }

Let me know if this helps.

huangapple
  • 本文由 发表于 2023年6月16日 06:07:52
  • 转载请务必保留本文链接：https://go.coder-hub.com/76485807.html
  • express
  • javascript
  • reactjs
  • stripe-payments
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定