What is JWT? How to use JWT in nodejs?

What is JWT? This article will take you to understand JWT, introduce the application of JWT innode, and the advantages and disadvantages of JWT. I hope it will be helpful to everyone!

What is JWT

JWT is the abbreviation ofJSON Web Token, which is to use on the Internet An authentication solution in the application environment. In the traditional authentication mechanism, it is nothing more than the following steps:

1. 用户将账号密码发送到服务器； 2. 服务器通过验证账号密码后，会在当前session中保存一些用户相关的信息，用户角色或者过期时间等等； 3. 服务器给用户一个session_id, 写入用户的Cookie或者客户端自行保存在本地； 4. 用户每次请求服务，都需要带上这个session_id，或许会通过Cookie，或者其他的方式； 5. 服务器接收到后，回去数据库查询当前的session_id，校验该用户是否有权限；

One advantage of this model is that the server can terminate the user's permissions at any time and modify it in the database Or delete the current user's session information. But there is also a disadvantage, that is, if it is a server cluster, all machines need to share the session information to ensure that each server can obtain the same session storage information. Although these problems can be solved, the amount of work is huge.

The advantage of the JWT solution is that this information is not saved. The token data is saved on the client. Every time a request is accepted, it only needs to be verified.

The principle of JWT

Let’s briefly talk about the principle of JWT. In fact, when the client sends a request for authentication, the server will generate a JSON object after authenticating the user. It probably includes information such as "Who are you, what do you do, etc.,Expiration time". The important thing is that there must be an expiration time; the general format is:

{ username: "贼烦字符串er", role: "世代码农", endTime: "2022年5月20日" }

But It will not be passed to you in such a superficial way. It will be signed and transmitted through a reversible signature algorithm based on the specified signature algorithm and some information about the payload you submitted. I will use a picture to represent the general format:

As can be seen from the picture, the returned information is roughly divided into three parts. The left side is the result after signing, which is the result returned to the client, and the right side is also the source code of Decoded. , the three parts are separated by "dots", and correspond to the three colors of red, purple, and cyan:

• The first red part is the Header, and the Header mainly specifies way, the signature algorithm in the figure (default HS256) is HMAC with SHA-256. It is a symmetric algorithm. Only one key is shared between the two parties, and the typ field is identified as JWT type;

• The second purple part payload is a JSON object, which is the actual data to be transmitted. There are seven official fields that can be used:

  • iss (issuer ): Issuer
  • exp (expiration time): Expiration time
  • sub (subject): Subject
  • aud (audience): Audience
  • nbf ( Not Before): Effective time
  • iat (Issued At): Issuance time
  • jti (JWT ID): Number

In addition to these Fields, you can also create some custom fields. Since JWT is not encrypted by default, try to be careful not to use some sensitive data when using it.

• The third part is theSignaturesignature. This part is a secret key specified by yourself and only exists on the server. Then use the algorithm specified in the header to pass the following signature method.

Simple use of JWT

Let’s experience the specific use:

Step one: We need to build A nodejs project; initialize a project throughnpm init -y; then we need to install dependencies, respectivelyexpress,jsonwebtokenandnodemonThree dependencies:

$ npm i express jsonwebtoken nodemon

Then add thenodemon app.jscommand in thescriptsfield inpackage.json:

"scripts": { "start": "nodemon app.js" },

The second step: Initialize the node application and create the app.js file in the root directory;

// app.js const express = require("express"); const app = express(); app.use(express.json()); app.listen(3000, () => { console.log(3000 + " listening..."); // 监听3000端口 });

The third step: Introduce thejsonwebtokendependency and create the interface and server The private key of Create a local simulation database for verification, and verify the signature through the

method:

// app.js //... const jwt = require("jsonwebtoken"); const jwtKey = "~!@#$%^&*()+,"; // ...

interface of/login. After verifying that the account and password completely match, we passedjsonwebtokenThe package imports thesignmethod under thejwtobject to sign. This method has three interface signatures:

export function sign( payload: string | Buffer | object, secretOrPrivateKey: Secret, options?: SignOptions, ): string; export function sign( payload: string | Buffer | object, secretOrPrivateKey: Secret, callback: SignCallback, ): void; export function sign( payload: string | Buffer | object, secretOrPrivateKey: Secret, options: SignOptions, callback: SignCallback, ): void;

这里用到了函数重载的方式实现接口，我们这里将实现最后一个接口签名，第一个参数可以是一个自定义的对象类型，也可以是一个Buffer类型，还可以直接是一个string类型，我们的源码使用了object类型，自定义了一些字段，因为jwt在进行签名是也会对这些数据一并进行签名，但是值得注意的是，这里尽量不要使用敏感数据，因为JWT默认是不加密的，它的核心就是签名，保证数据未被篡改，而检查签名的过程就叫做验证。

export interface SignOptions { algorithm?: Algorithm | undefined; keyid?: string | undefined; expiresIn?: string | number | undefined; /** expressed in seconds or a string describing a time span [zeit/ms](https://github.com/zeit/ms.js). Eg: 60, "2 days", "10h", "7d" */ notBefore?: string | number | undefined; audience?: string | string[] | undefined; subject?: string | undefined; issuer?: string | undefined; jwtid?: string | undefined; mutatePayload?: boolean | undefined; noTimestamp?: boolean | undefined; header?: JwtHeader | undefined; encoding?: string | undefined; }

POST http://localhost:3000/login content-type: application/json { "username": "username", "password": "password" }

app.get("/afterlogin", (req, res) => { const { headers } = req; const token = headers["authorization"].split(" ")[1]; // 将token放在header的authorization字段中 jwt.verify(token, jwtKey, (err, payload) => { if (err) return res.sendStatus(403); res.json({ message: "认证成功", payload }); }); });

// 有四个接口签名，可以自行查文档 export function verify( token: string, // 需要检验的token secretOrPublicKey: Secret | GetPublicKeyOrSecret, // 定义在服务器的签名秘钥 callback?: VerifyCallback, // 获取校验信息结果的回调 ): void;

### GET http://localhost:3000/afterlogin authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVzZXJuYW1lIiwiaWF0IjoxNjUyNzg5NzA3LCJleHAiOjE2NTI3ODk3Mzd9.s9fk3YLhxTUcpUgCfIK4xQN58Hk_XEP5y9GM9A8jBbY