basicAuth和jwt

basicAuth前端提交方式：

》业务逻辑：前端通过basicAuth携带token请求AP，后端接受到请求，通过basicAuth解码获得token，然后解密获取token携带的用户uid和用户权限scope，然后判断是否存在该uid，如果存在判断token是否过期，否则继续判断该uid的访问权限scope。
》postman basicAuth默认base64加密；
》postman post请求默认带 basicAuth验证；get请求没有；
》Authorization格式：Authorization: Basic $(base64_encode({username}:{password}))；

import {
  Base64
} from './base64.js'
wx.request({
      url: config.api_base_url + url,
      method: method,
      data: data,
      header: {
        'content-type': 'application/json',
        Authorization: this._encode()  // basicAuth验证
      },
      success: (res) => {},
      fail: (err) => {}
    })

  _encode() {
    const token = wx.getStorageSync('token')
    const base64 = new Base64()
    const result = base64.encode(token + ':')
    // 格式：Authorization: Basic $(base64_encode({username}:{password})) 
    return 'Basic ' + result
  }

后端获取baseAuth信息：

const basicAuth = require('basic-auth')
const userToken = basicAuth(ctx.req)
// 将获取到的username和password跟后端比较

以中间件的形式校验前端token：

const basicAuth = require('basic-auth')
const jwt = require('jsonwebtoken')

/*********以中间件的形式校验前端token*****************/
class Auth {
    constructor(level) {
        this.level = level || 1
        Auth.USER = 8
        Auth.ADMIN = 16
        Auth.SUPER_ADMIN = 32
    }

    get m() {
        return async (ctx, next) => {
            
            const userToken = basicAuth(ctx.req)
            let errMsg = 'token不合法'

            if (!userToken || !userToken.name) {
                throw new global.errs.Forbbiden(errMsg)
            }
            try {
                var decode = jwt.verify(userToken.name, 
                    global.config.security.secretKey)
            } catch (error) {
                if (error.name == 'TokenExpiredError'){
                    errMsg = 'token已过期'
                }
                throw new global.errs.Forbbiden(errMsg)
            }

            if(decode.scope < this.level){
                errMsg = '权限不足'
                throw new global.errs.Forbbiden(errMsg)
            }

            // uid,scope
            ctx.auth = {
                uid:decode.uid,
                scope:decode.scope
            }

            await next()
        }
    }
}

module.exports = {
    Auth
}

颁发token令牌：

const generateToken = function(uid, scope){
    const secretKey = global.config.security.secretKey
    const expiresIn = global.config.security.expiresIn
    const token = jwt.sign({
        uid,
        scope
    },secretKey,{
        expiresIn
    })
    return token
}

config文件相关配置信息：

module.exports = {
    ...
    security:{
        secretKey:"abcdefg",    // 密匙
        expiresIn:60*60*24*30  // 有效时间 30天
    },
    ...
}

API调用token验证：

router.get('/favor', new Auth().m, async ctx => {
    ...
})

颁发token：

async function emailLogin(account, secret) {
    const user = await
        User.verifyEmailPassword(account, secret)
    return token = generateToken(user.id, Auth.USER)
}