The difference between laravel's passport and jwt

Introduction

Passport is a Node.js middleware that provides a variety of different request authentications that are easy to implement. Strategy. By default, it stores the user object in the session. (Recommended learning: laravel development)

JSON Web Token is an authentication standard that works by assigning and passing encrypted tokens in requests that help identify logged in users , instead of storing the user in a session on the server and creating a cookie to work. It has different integrations, including Node.js modules.

Install dependencies.

npm install --save koa-passport  passport-jwt jsonwebtoken

Process

When the user logs in, the backend creates the signed token and returns it as a response

The client is in Save the token locally (usually in localStorage) and send it back on every subsequent request that requires authentication

All requests that require authentication check the provided token through the middleware, and only The request is only allowed when the token is verified

Token when logging in

/**
 * @route POST api/users/login
 * @desc 用户登录接口
 * @access 都可访问
 */
router.post('/login', async ctx => {
    	//...获取数据 验证数据省略
        const payload = {
            name: user.name,
            email,
            avatar: user.avatar
        };
        //生成token
        const token = jwt.sign(payload, config.secretKey, {
            expiresIn: 3600 //存活时间
        });
        ctx.status = 200;
        ctx.body = {
            message: '验证成功',
            token: 'Bearer ' + token
        }
})

Note: There must be a space in the middle of 'Bearer', and the case is also distinguished...

Login parsing Token

/**
 * @route GET api/users/current
 * @desc 获取用户信息
 * @access 私密接口
 */
 //poassport.authenticate 则加入了认证权限,会调用 passport.js中
router.get('/current',passport.authenticate('jwt', { session: false }),async ctx=>{
	//获取 passport.js 中的返回值,去除密码并将结果返回到客户端
    const {password,...userInfo}=ctx.state.user._doc;
    ctx.body=userInfo;
})

//app.js
const passport = require('koa-passport');
app.use(passport.initialize())
app.use(passport.session())
//调用 passport.js 并将passport传入
require('./config/passport')(passport);

config/passport.js

const config=require('./default');
const JwtStrategy = require('passport-jwt').Strategy,
    ExtractJwt = require('passport-jwt').ExtractJwt;
const opts = {}
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
opts.secretOrKey = config.secretKey;
// const User=require('../models/User');
const mongoose=require('mongoose');
const User=mongoose.model('users');
module.exports=passport=>{
    passport.use(new JwtStrategy(opts,async (jwt_payload,done)=>{
    	//jwt_payload 返回的是登录时返回的数据 即payload
        const user=await User.findOne(jwt_payload.id);
        if(user){
            done(null,user);
        }else{
            done(null,false);
        }
    }))
}

ps. This is the complete code of the user login template

app.js

const Koa=require('koa');
const KoaRouter=require('koa-router');
const bodyParser=require('koa-bodyparser');
const mongoose=require('mongoose');
//const config=require('./config/default')
const passport = require('koa-passport');
//配置文件 这里就不单独抽离
const config={
	mogoUrl:'mongodb://localhost/koaTest',
    secretKey:'sercretKey',
}

const router=new KoaRouter();
const app=new Koa();

app.use(bodyParser());
//初始化 passport
app.use(passport.initialize())
app.use(passport.session())


//连接数据库
mongoose.connect(config.mogoUrl,{
    useNewUrlParser:true
}).then(res=>{
    console.log('mongoose connectd...');
})
.catch(error=>{
    console.log(error)
})

//引入 user.js
const user=require('./routes/api/user');

require('./config/passport')(passport);

//配置路由地址
router.use('/api/users',user);

//配置路由
app.use(router.routes()).use(router.allowedMethods());
const port=process.env.PORT||5000;
//监听端口
app.listen(port,()=>{
    console.log(`listing at ${port}`)
})

routes/api/user.js

var Router = require('koa-router');
var router = new Router();
const User = require('../../models/User')
const bcrypt = require('bcryptjs');
const tools = require('../../config/tools')

const jwt = require('jsonwebtoken'); //token 认证
const config = require('../../config/default');
const passport=require('koa-passport');

/**
 * @route POST api/users/login
 * @desc 用户登录接口
 * @access 都可访问
 */
router.post('/login', async ctx => {
    const {
        email,
        password
    } = ctx.request.body;
    const findResult = await User.find({
        email
    });
    const user = findResult[0];
    if (findResult.length === 0) {
        //表示不存在该用户
        ctx.status = 404;
        ctx.body = {
            message: '该用户不存在'
        };
        return;
    }
    //验证密码是否正确
    const verify = bcrypt.compareSync(password, user.password);
    if (verify) {
        //密码正确
        const payload = {
            name: user.name,
            email,
            avatar: user.avatar
        };
        //生成token
        const token = jwt.sign(payload, config.secretKey, {
            expiresIn: 3600
        });

        ctx.status = 200;
        ctx.body = {
            message: '验证成功',
            token: 'Bearer ' + token
        }
    } else {
        ctx.status = 500;
        ctx.body = {
            message: '密码错误'
        };
    }

})

/**
 * @route GET api/users/current
 * @desc 获取用户信息
 * @access 私密接口
 */
router.get('/current',passport.authenticate('jwt', { session: false }),async ctx=>{
    const {password,...userInfo}=ctx.state.user._doc;
    ctx.body=userInfo;
})
module.exports = router.routes();

The above is the detailed content of The difference between laravel's passport and jwt. For more information, please follow other related articles on the PHP Chinese website!