27 lines
1.2 KiB
JavaScript
27 lines
1.2 KiB
JavaScript
const { inject } = require('../common/Provider');
|
||
const { verifyToken, createToken } = require('../utils/jwt');
|
||
const ignoreToken = ['/sign/check', '/sign/in', '/sign/up', '/sign/upwi', '/sign/forget', '/sign/send', '/sign/changePwd', '/sign/code'];
|
||
module.exports = {
|
||
auth: inject(function (SysConfig) {
|
||
const { JWT_SECRET } = SysConfig;
|
||
return async (req, res, next) => {
|
||
const token = req.headers.token;
|
||
if(!ignoreToken.includes(req.path)) {
|
||
if (token) {
|
||
const deToken = await verifyToken(token, JWT_SECRET);
|
||
if(deToken) {
|
||
res.locals.user = deToken.data;
|
||
// 换发新token，存在问题：如果上一个token没过期，其他人截获了的话，会不会被盗用？
|
||
res.set('token', createToken({
|
||
userId: deToken.userId
|
||
}, JWT_SECRET, {}));
|
||
return next();
|
||
}
|
||
}
|
||
return res.status(403).send('unauthorized');
|
||
} else {
|
||
next();
|
||
}
|
||
};
|
||
})
|
||
}; |