egg-jwt 签名成功，并且请求时也有附带 token，但是后台一直报No authorization token was found

签名成功，并且请求时也有附带 token，但是后台一直报No authorization token was found

Open cuevven opened this issue 4 years ago • 4 comments

// config/config.default.js
    jwt: {
      secret: 'Great4-M',
      enable: true,
      ignore: '/api/user/access/login',
    }

// app/router.js
  const { router, controller, middleware } = app;
  const jwt = middleware.jwt(app.config.jwt);
  router.get('/api/user', jwt, controller.user.index)

// Request Headers
GET /api/user?page=1&limit=20 HTTP/1.1
Host: 127.0.0.1:7001
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/plain, */*
Sec-Fetch-Dest: empty
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7Il9pZCI6IjVlODYwNDk4ZjZmOTU4Nzk5MmU2NzdhMiJ9LCJleHAiOjE1ODY3MDQyMjgsImlhdCI6MTU4NjA5OTQyOH0.AX03Jfv5g9cAVv9apBb3gpNlY-lHMjkChmhG6TNNmJA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Origin: http://localhost:9528
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Referer: http://localhost:9528/dashboard
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.6

// server log
2020-04-05 23:20:26,620 WARN 78099 [-/127.0.0.1/-/0ms GET /api/user?page=1&limit=20] nodejs.UnauthorizedError: No authorization token was found
    at middleware (/node_modules/koa-jwt2/lib/index.js:89:15)
    at fn (/node_modules/egg-core/lib/loader/mixin/middleware.js:112:12)
    at dispatch (/node_modules/koa/node_modules/koa-compose/index.js:42:32)
    at /node_modules/egg-development/app/middleware/egg_loader_trace.js:9:56
    at dispatch (/node_modules/koa/node_modules/koa-compose/index.js:42:32)
    at i18n (/node_modules/egg-i18n/app/middleware/i18n.js:13:12)
    at dispatch (/node_modules/koa/node_modules/koa-compose/index.js:42:32)
    at dispatch (/node_modules/egg-security/node_modules/koa-compose/index.js:42:32)
    at dta (/node_modules/egg-security/lib/middlewares/dta.js:12:12)
    at dispatch (/node_modules/egg-security/node_modules/koa-compose/index.js:42:32)
    at xframe (/node_modules/egg-security/lib/middlewares/xframe.js:7:11)
    at dispatch (/node_modules/egg-security/node_modules/koa-compose/index.js:42:32)
    at xssProtection (/node_modules/egg-security/lib/middlewares/xssProtection.js:7:11)
    at dispatch (/node_modules/egg-security/node_modules/koa-compose/index.js:42:32)
    at nosniff (/node_modules/egg-security/lib/middlewares/nosniff.js:8:11)
    at dispatch (/node_modules/egg-security/node_modules/koa-compose/index.js:42:32)
name: "UnauthorizedError"
message: "No authorization token was found"
code: "credentials_required"
status: 401
inner: {"message":"No authorization token was found"}
pid: 78099

Apr 05 '20 15:04 cuevven

更新：只有 get 请求会遇到这个问题。还没找到原因和解决方法。更新：前端只发送了一次 GET，后端响应两次。没明白第二次带 cookie 那个响应的请求是从哪发出的？？

koa-jwt:options>>>>>>>>>>>>>>>>>>> { secret: 'Great4-M', enable: false, ignore: '/api/user/access/login' }
koa-jwt:request>>>>>>>>>>>>>>>>>>> {
  request: {
    method: 'GET',
    url: '/api/user?page=1&limit=20',
    header: {
      host: '127.0.0.1:7001',
      connection: 'keep-alive',
      pragma: 'no-cache',
      'cache-control': 'no-cache',
      accept: 'application/json, text/plain, */*',
      'sec-fetch-dest': 'empty',
      authorization: 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7Il9pZCI6IjVlODYwNDk4ZjZmOTU4Nzk5MmU2NzdhMiJ9LCJleHAiOjE1ODY4NzIzMTksImlhdCI6MTU4NjI2NzUxOX0.KuWrp1fGjOCHiRXUl5DS9kIpkhd9j7lQGjkYI08U0sU',
      'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36',
      origin: 'http://localhost:9528',
      'sec-fetch-site': 'cross-site',
      'sec-fetch-mode': 'cors',
      referer: 'http://localhost:9528/dashboard',
      'accept-encoding': 'gzip, deflate, br',
      'accept-language': 'en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.6'
    }
  }
}
koa-jwt:request>>>>>>>>>>>>>>>>>>> GET /api/user?page=1&limit=20
koa-jwt:token>>>>>>>>>>>>>>>>>>> Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7Il9pZCI6IjVlODYwNDk4ZjZmOTU4Nzk5MmU2NzdhMiJ9LCJleHAiOjE1ODY4NzIzMTksImlhdCI6MTU4NjI2NzUxOX0.KuWrp1fGjOCHiRXUl5DS9kIpkhd9j7lQGjkYI08U0sU

koa-jwt:options>>>>>>>>>>>>>>>>>>> { secret: 'Great4-M', enable: false, ignore: '/api/user/access/login' }
koa-jwt:request>>>>>>>>>>>>>>>>>>> {
  request: {
    method: 'GET',
    url: '/api/user?page=1&limit=20',
    header: {
      host: '127.0.0.1:7001',
      connection: 'keep-alive',
      'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36',
      'sec-fetch-dest': 'empty',
      accept: '*/*',
      'sec-fetch-site': 'none',
      'sec-fetch-mode': 'cors',
      'accept-encoding': 'gzip, deflate, br',
      'accept-language': 'en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.6',
      cookie: 'remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IkdBbGdxbkN3dHJhV1wvdlhpZmU5K293PT0iLCJ2YWx1ZSI6IlJCWG9DWlhGR2x5eDB0UDI2OUh4ekpleGF2blwvYkRVcGVvWWh1QlFSVG9VcWptSDBkMkJpMnRuVmM5cE82N3VNYnVBVmRhY0x1M0hoamNMOHZtNXlWdnhhZW1DVHQ3cmgzNjA1b0h3Tkx1UndIejlWeGxZVUtLU2doXC9TSkFNbVhlNGJEZ0xROG9iR1dHOW5FWURGVU53TWFOMDhQVU9NQXp1UHJPdzRyOTRVPSIsIm1hYyI6Ijc4YjFjZTNhMDdmMzUzYmViZDM3ZDNkYTVkOTM2ZGEzM2IwNTk0NmQ4YjEzMDI5MjcyODA1MmIxZjNiZTkwN2EifQ%3D%3D; io=H0XrH9yzK4tBS7inAAGG; view=50; csrfToken=IKPRpHfru0E803qN3VlPyQGi; localauth=localapi95077028f477df04:; backendVersion=1.0.7.2315; isNotIncognito=true; _ga=GA1.1.711480577.1579182169; ki_t=1579182169967%3B1579182169967%3B1579182169967%3B1%3B1; ki_r='
    }
  }
}
koa-jwt:request>>>>>>>>>>>>>>>>>>> GET /api/user?page=1&limit=20
koa-jwt:token>>>>>>>>>>>>>>>>>>> 
2020-04-07 23:25:13,171 WARN 65477 [-/127.0.0.1/-/0ms GET /] nodejs.UnauthorizedError: No authorization token was found

Apr 06 '20 15:04 cuevven

@cuevven 您好： router.get('/api/user', jwt, controller.user.index) 这个 get 请求的 token怎么带上的？自定义请求头里面设置么。

Dec 08 '20 15:12 LuvFishBone

@cuevven 我这里是服务端渲染然后这个 token不知道怎么带上 adminRoutes.map(route => { router.get(${route.path}, getEntry({ entry: route.entry }), app.jwt, controller[route.controller][route.handler]) })

Dec 08 '20 15:12 LuvFishBone

我今天用egg-jwt的时候也是老报这个错 name: "UnauthorizedError" message: "invalid signature" code: "invalid_token" 最后在网上找到一个方法设置一个middleware在里面自己try catch验证token，然后我发现验证回来的token必须去掉前面的Bearer 比如用subtring(7)然后就可以验证成功了。

'use strict';

module.exports = options => {
  return async function jwt(ctx, next) {
    const token = ctx.request.header.authorization.substring(7);
    let decode;
    if (token) {
      try {
        // 解码token
        decode = ctx.app.jwt.verify(token, options.secret);
        await next();
      } catch (error) {
        ctx.status = 401;
        ctx.body = {
          message: error.message,
        };
        return;
      }
    } else {
      ctx.status = 401;
      ctx.body = {
        message: '没有token',
      };
      return;
    }
  };
};

参考 https://blog.csdn.net/qq_32674347/article/details/104117594 https://www.jianshu.com/p/407833ce84e1

希望对你有帮助也希望有大佬告诉我一下，我没写中间件的时候是不是自动给我验证token的时候没有去掉Bearer？我用try catch刚开始没有去掉也还是401

Aug 03 '21 09:08 Ha0ran2001

egg-jwt egg-jwt copied to clipboard

签名成功，并且请求时也有附带 token，但是后台一直报No authorization token was found

egg-jwt
egg-jwt copied to clipboard